Glossary
CORS
Meaning and details
CORS, Cross-Origin Resource Sharing, is the browser's rulebook for cross-site requests. By default, JavaScript on origin A cannot read responses from origin B: this is the same-origin policy, and it is why an arbitrary p...
CORS meaning
The browser security policy that controls which origins may request resources from another, enforced via HTTP response headers.
What is CORS?
CORS, Cross-Origin Resource Sharing, is the browser's rulebook for cross-site requests. By default, JavaScript on origin A cannot read responses from origin B: this is the same-origin policy, and it is why an arbitrary page cannot silently call your bank's API with your cookies. CORS is the negotiated exception: your server declares, via response headers, which origins may call it and which methods and headers are allowed, and the browser enforces the contract.
Why it matters to an indie builder: the first time you put a frontend on one domain and an API on another, you meet CORS in the console, usually as a red error and a blocked request. Knowing that the fix belongs on the server, as an Access-Control-Allow-Origin header, and not in the frontend, saves an hour of cargo-culting. It is also a security feature you are configuring, not an obstacle: an API with permissive CORS plus credentials is a wide-open door.
A concrete example: a React app on app.example.com calling api.example.com. Without CORS headers, every request fails preflight. The API adds Access-Control-Allow-Origin set to the exact frontend origin, allows the Authorization header and the methods in use, and the browser stops blocking. Setting the wildcard with credentials enabled instead, the lazy configuration, tells browsers to reject credentialed requests entirely: stricter is safer here, and it is also what actually works.
Common mistakes: wildcard-plus-credentials, which browsers forbid and which silently breaks login, solving CORS with a proxy in development and shipping a different configuration than production tests, confusing server enforcement with browser enforcement (curl ignores CORS; the browser is the police, so test in one), and treating preflight OPTIONS requests as noise to block, which kills the actual request that was about to follow. The api trait blocks on IndieBoot mark services with first-class CORS configuration.