What is CORS?

A browser safety rule: a website may only read replies from another site's API if that API says it's allowed.

Where CORS goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

  • The life of a click · 4 minutes · Pro

    Blocked by CORS

    Your API works in Postman. In the browser: 'blocked by CORS policy'. Your AI has 'fixed' the frontend three times.

    How do I fix 'blocked by CORS policy'?

    Fix it on the server that answers the request, not in your frontend. Browsers send a preflight OPTIONS request first; the API must reply with headers allowing your site's origin and the headers you use. Allow only your own origins rather than everyone, and remember CORS is not authentication.

    Read the fix

Related terms

API
The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Request
A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Response
The server's reply to a request: the data, plus a status code saying whether it worked.
Server
A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Browser
Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Policy
One rule in Row Level Security, such as 'people can read only their own orders'.

All 62 terms in the glossary