EduByte.tech
Start learning
AJAX & Async Requests·AJAX from first request to live updates

CORS

Understand preflight, allowed origins and credentialed requests.

Beginner 13 min read Lesson 7 of 300 Challenge included
What you will be able to do
  • CORS is enforced by the browser.
  • Preflight is an OPTIONS request.
  • Wildcard origins cannot be used with credentials.
  • Fix CORS on the server.

In plain English

CORS is a browser policy that lets a server opt into cross-origin reads. Simple requests are sent directly; others trigger an OPTIONS preflight. The server, not the client, decides with Access-Control-Allow-Origin.

cors.httpHTTP
Access-Control-Allow-Origin: https://www.edubyte.tech
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Credentials: true
Your turn

Allow one origin

Easy

Write an Access-Control-Allow-Origin header for https://www.edubyte.tech.

HTTP · starter
Access-Control-Allow-Origin:
Check your understanding before moving on.
Knowledge checkQuestion 1

Which request method does a preflight use?

Select an answer to continue
Study tools

Make it yours.

Keep a private note for this lesson, then turn the key ideas into flashcards you can revisit.

Sign in to save notes and flashcards.Both are private to your account and stay with your progress.
Sign in
Finished reading?

Lock in what you just learned.

Mark this lesson complete to save your place and move one step closer to the certificate.

Next: Polling and streaming
Lesson 7 of 300 · 0% of course