CORS: a boundary the browser enforces

CORS does not protect the server; it limits what other sites can read through the user’s browser.

UnderstandStudy an examplePractise

Understand the concept

The same-origin policy stops JavaScript on one site from reading responses from another origin by default. An origin combines scheme, host and port. CORS (Cross-Origin Resource Sharing) is the server loosening that restriction in a controlled way by saying ‘these origins may read my responses’.

For non-simple requests (for example a POST with a JSON body or a custom header) the browser first sends an OPTIONS ‘preflight’. If the server answers with permitting headers, the real request follows. CORS errors appear in the browser console; curl and server-to-server calls have no CORS at all.

This is why CORS is not authentication: an attacker can always call your API outside a browser. In this project the browser never calls the API directly; it goes through Next.js on the same origin. CORS never comes into play and the API stays reachable only from the private network.

WHEN TO USE IT

To read CORS errors correctly and not mistake CORS for security.

COMMON PITFALL

‘Fixing’ errors by trying to combine Access-Control-Allow-Origin: * with credentials.

01 / PRACTICE

One topic. Three levels of depth.

Illustrative example

https://ataberksahin.net  ve  https://api.ataberksahin.net
→ alan adı farklı → farklı köken → CORS gerekir

Even a subdomain changes the origin.

This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.

02 / YOUR TURN

Try it yourself first.

You enabled CORS only for your own site. Someone says ‘Now my API is safe, other sites can’t use it’. What is wrong with that?

Show the solution and explanation

Worked solution

CORS yalnız tarayıcıların başka kökenlerden yanıt okumasını sınırlar.
curl, Postman veya bir sunucu API’yi yine çağırabilir.
Gerçek koruma: kimlik doğrulama, yetkilendirme, hız sınırı.

CORS protects users from other sites reading data through their browser; it does not protect the API from clients.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.