CORS
Cross-Origin Resource Sharing controls which cross-origin responses browser scripts may read.
Use this when A browser frontend calls an API on another origin.
without the term
“My frontend on localhost:3000 can't call the API on localhost:8000, the console says blocked by CORS policy. Can you fix it without just allowing everything?”
with the term · How do you ask a model for CORS?
Configure CORS for these frontend origins. Verify allowed and disallowed origins, credential handling, and preflight responses.
What is CORS?
The browser lets a page read a response from another origin only if that server's CORS headers allow it. CORS does not stop the request from being sent and does not authenticate anyone.
Why does CORS matter when vibe coding?
Reflecting any Origin can unintentionally grant response access.
How do you do CORS?
Allow only intended origins and credential behavior; test preflight and actual requests.
What goes wrong with CORS?
Testing only with a command-line client that does not enforce browser CORS.