A Hacker News Discussion with 176 Points

Developers Don't Understand CORS

Based on fosterelli.co

2019

02

The Problem

Why CORS remains one of the most misunderstood web security concepts

What is CORS?

01

Cross-Origin Resource Sharing A browser security mechanism that controls how web pages can request resources from different domains
02

Browser-Side Enforcement CORS is enforced by the browser, not the server—it blocks cross-origin requests that lack proper permissions
03

Security vs Functionality Designed to prevent malicious sites from accessing sensitive data on other domains
04

Same-Origin Policy CORS relaxes the same-origin policy to allow controlled cross-origin access

Common Misconceptions

What developers often get wrong about CORS

block

Server-Side Only

CORS is purely a server configuration issue

security

Complete Protection

CORS protects against all security threats

error

Server is Broken

CORS errors mean the backend is malfunctioning

toggle_off

Just Disable It

Turning off CORS solves the problem

05

The Reality

Understanding the complexity behind CORS errors

The CORS Flow

1

Browser Request

Client initiates cross-origin request

→

2

Preflight Check

Browser sends OPTIONS request for complex requests

→

3

Server Response

Server responds with CORS headers

→

4

Browser Decision

Browser validates and allows or blocks

→

5

Final Request

Actual request proceeds if permitted

CORS is fundamentally about trust. When a browser enforces CORS, it's asking: "Should I trust this origin with the response?"

From the discussion

Thank You

Understanding CORS leads to better, more secure web applications

https://fosterelli.co/developers-dont-understand-cors