Cross-Origin Resource Sharing (CORS) is a mechanism that allows a web page to make requests to a server that is located at a different domain. It is designed to prevent web pages from making requests to a server that is not authorized to access the requested resource.
By default, web browsers block web pages from making requests to a server at a different domain for security reasons. This is known as the same-origin policy. However, there are many legitimate use cases where a web page needs to make requests to a server at a different domain, such as when integrating with third-party APIs or loading content from a Content Delivery Network (CDN).
To allow a web page to make requests to a server at a different domain, the server must include CORS headers in its responses. These headers indicate which domains are allowed to make requests to the server and which HTTP methods are allowed.
For example, if a web page at "example.com" wants to make a request to a server at "api.example.com", the server at "api.example.com" must include the following header in its responses:
Access-Control-Allow-Origin: example.com
This allows the web page at "example.com" to make requests to the server at "api.example.com". The server can also specify which HTTP methods are allowed by including the "Access-Control-Allow-Methods" header.
CORS is an important security feature that helps to prevent Cross-Site Scripting (XSS) attacks by limiting the domains that are allowed to make requests to a server. It is an important aspect of web development and is widely used to enable integration with third-party APIs and other services.