Glossary of Security Terms: CORS

CORS (Cross-Origin Resource Sharing) is a system, consisting of transmitting HTTP headers, that determines whether browsers block frontend JavaScript code from accessing responses for cross-origin requests.

The same-origin security policy forbids cross-origin access to resources. But CORS gives web servers the ability to say they want to opt into allowing cross-origin access to their resources.

Learn more

General knowledge

• Cross-Origin Resource Sharing (CORS) on MDN
• Cross-origin resource sharing on Wikipedia

CORS headers

Access-Control-Allow-Origin

Indicates whether the response can be shared.

Access-Control-Allow-Credentials

Indicates whether or not the response to the request can be exposed when the credentials flag is true.

Access-Control-Allow-Headers

Used in response to a preflight request to indicate which HTTP headers can be used when making the actual request.

Access-Control-Allow-Methods

Specifies the method or methods allowed when accessing the resource in response to a preflight request.

Access-Control-Expose-Headers

Indicates which headers can be exposed as part of the response by listing their names.

Access-Control-Max-Age

Indicates how long the results of a preflight request can be cached.

Access-Control-Request-Headers

Used when issuing a preflight request to let the server know which HTTP headers will be used when the actual request is made.

Access-Control-Request-Method

Used when issuing a preflight request to let the server know which HTTP method will be used when the actual request is made.

Origin

Indicates where a fetch originates from.

Technical reference

• Fetch specification

View Previous Terms:

• Block cipher mode of operation
• Certificate authority
• Challenge-response authen tication
• Cipher
• Cipher suite
• Ciphertext
• CORS-safelisted request header
• CORS-safelisted response header
• Cross-site scripting
• Cryptanalysis
• Cryptographic hash function
• Cryptography
• CSP
• CSRF
• Decryption
• Digital certificate
• DTLS (Datagram Transport Layer Security)
• Encryption
• Forbidden header name
• Forbidden response header name
• Hash
• HMAC
• HPKP
• HSTS
• HTTPS
• Key
• MitM
• OWASP
• Preflight request
• Public-key cryptography
• Reporting directive
• Robots.txt
• Same-origin policy
• Session Hijacking
• SQL Injection
• Symmetric-key cryptography
• TOFU
• Transport Layer Security (TLS)

Credits

• Source: https://developer.mozilla.org/en-US/docs/Glossary/CORS
• Published under Open CC Attribution ShareAlike 3.0 license