What Is CORS?
What is CORS?
Answer out loud in under a minute: a definition, one concrete example, and one pitfall or trade-off.
Hints
Hint 1
Say what the browser blocks, how a server opts in, and when a preflight happens.
Solution
Show the approach
Answer
Browsers block a page from reading responses from another origin (scheme, host and port) unless the server opts in with Access-Control-Allow-Origin. Requests that are not "simple" trigger an OPTIONS preflight first. With credentials, the origin must be named exactly, and a wildcard is refused. CORS protects users, not servers: any non-browser client can still call the API.