Glossary term
What is CORS (Cross-Origin Resource Sharing)?
CORS stands for Cross-Origin Resource Sharing.
In DevOps
The browser rule that stops a page on one site calling another site unless that site agrees. Browser uploads straight to S3 need a CORS configuration on the bucket.
Learn it properly · DevOpsLesson 11: S3 and CloudFront: Static Assets and CDNUploads, images and built assets in S3, served from edge locations near your users.In System Design
Lets a server allow web pages from other domains to call it. Example: Your React app on app.com calling api.com.
Learn it properly · System DesignLesson 3: HTTP & HTTPS Explained: Methods, Status Codes and TLSHTTP is the shared language of the web: a method and URL in, a status code and body out. HTTPS wraps it in TLS so nobody on the path can read or change it. Methods, idempotency, status codes, HTTP/1.1 vs 2 vs 3, and the TLS handshake.In The Browser Contract
A set of headers where a server says which other sites may read its answers. Only browsers enforce it. It does not protect the server like a firewall.
Learn it properly · The Browser ContractLesson 4: CORS Explained: Same-Origin Policy, Preflights and CredentialsWhy CORS protects the browser and is not a firewall for the server, what makes a preflight request, and why you cannot use a wildcard origin together with credentials.In Security for Developers
Response headers that tell the browser which other websites may read this server's responses; the browser enforces it, not the server.
Learn it properly · Security for DevelopersLesson 7: APIs and Servers: SSRF, File Uploads, Rate Limits and MisconfigurationServer-side request forgery, unsafe file uploads, missing rate limits, verbose errors, CORS mistakes and the OWASP API Top 10, each with a small example and a fix.In Next.js App Router
A browser rule that lets a page read a response from another origin only if that response has the right permission headers.
Learn it properly · Next.js App RouterLesson 4: Route Handlers, Middleware (Proxy) and APIsWriting API endpoints, request and response helpers, the request interception layer in this Next.js version, headers, redirects and rewrites.