Developers don't understand CORS (2019)
Many developers misunderstand CORS, believing it is a server-side security measure. In reality, CORS is a browser-enforced policy that restricts frontend JavaScript from reading cross-origin responses, but does not block requests from non-browser clients or server-to-server communication.
Background
- CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls which websites are allowed to access resources (like APIs) from a different domain. It's enforced by the browser, not the server.
- Many developers mistakenly think CORS errors mean a request was blocked; in reality, the browser sends the request and only denies the JavaScript response if the server doesn't signal permission via specific HTTP headers.
- Common misunderstandings: that CORS prevents the request from reaching the server (it does reach the server), or that adding CORS headers on the client side can fix it (the headers must come from the server).
- This post, written by a senior backend developer in 2019, became well-known because it articulates a widespread frustration: even experienced developers tend to rely on trial-and-error "CORS hacks" rather than understanding the underlying protocol.