143
CORS
The browser asks your server whether another origin may read the response. `*` plus cookies is not a configuration.
What is CORS?
Cross-origin resource sharing is a browser rule. The server opts in with headers. It does not block non-browser clients. `Access-Control-Allow-Origin: *` cannot be combined with credentialed requests. Reflecting the request origin without a check is the same as allowing anyone.
Why does CORS matter when vibe coding?
Models set `origin: true` on the CORS middleware to kill the console error. Any site can then call your API with the user’s cookies. Name the allowlist.
How do you do CORS?
Allowlist exact origins. Allow credentials only for those. Do not reflect `Origin` blindly. Remember CORS is not authorization.
How do you ask a model for CORS?
CORS allowlist is exactly (origins). Do not use * with credentials. Do not reflect the request Origin. CORS is not a substitute for authentication.
What goes wrong with CORS?
Disabling CORS in the browser as the fix. You hid the error on your machine. Users still have the policy.