CORS – Definition, Use Cases and Best Practices at a Glance
A browser security mechanism that controls which websites may access resources on other domains (origins) using special HTTP headers.
What is CORS? Definition, How It Works & Troubleshooting
CORS (Cross-Origin Resource Sharing) is one of the most common stumbling blocks in web development – almost every developer has seen 'Access to fetch has been blocked by CORS policy'. Behind it is an important security mechanism: it stops a malicious site from making API requests to other services in the background and stealing data. Understood and configured correctly, CORS is not an obstacle but a core part of web security.
This glossary entry for CORS gives you a clear Definition, practical Use Cases and Best Practices at a glance – with examples, pros and cons, and FAQs.
What is CORS?
- CORS – A browser security mechanism that controls which websites may access resources on other domains (origins) using special HTTP headers.
CORS is an HTTP-header-based mechanism that lets web servers specify which other origins (protocol + domain + port) may access their resources. Browsers block cross-origin requests by default (same-origin policy). CORS relaxes this in a controlled way: the server uses the Access-Control-Allow-Origin header to list allowed origins.
For non-simple requests (e.g. custom headers or PUT/DELETE), the browser sends a preflight (OPTIONS) request first to learn allowed methods and headers. Other CORS headers control whether credentials may be sent, which methods are allowed and how long the preflight result may be cached.
How does CORS work?
When a page on https://app.example.com calls an API on https://api.example.com, the browser applies the same-origin policy: different subdomains are different origins. For simple GET requests the browser sends the request and checks the response’s Access-Control-Allow-Origin.
For non-simple requests it first sends an OPTIONS preflight; the server responds with allowed origins, methods and headers. Only if that matches does the browser send the real request. This check happens only in the browser – server-to-server calls are not affected.
Practical Examples
A React app on https://app.firma.de calls an API on https://api.firma.de – CORS must be configured because different subdomains are different origins.
A SaaS product exposes a public API and sets Access-Control-Allow-Origin: * for read-only endpoints but specific origins for write operations.
A developer debugs a CORS error: the API allows the right origin but the custom header X-API-Key is missing from Access-Control-Allow-Headers.
A finance portal uses CORS with credentials (Access-Control-Allow-Credentials: true) to send cookies for auth across subdomains.
A microservice setup uses an API gateway that configures CORS once for all backend services.
Typical Use Cases
Single-page applications: Frontend and backend on different domains or ports must communicate via CORS
Microservices: Services on different subdomains must talk to each other and to the frontend
Public APIs: Third-party sites should be able to access your API in a controlled way
Development: Local frontend (localhost:3000) calling API (localhost:8080)
Embedded widgets: Chat or analytics on other sites that talk to your server
Advantages and Disadvantages
Advantages
- Protection against cross-site abuse: Stops malicious sites from making API requests on behalf of the user
- Granular control: Allowed origins, methods, headers and credentials are configurable
- Browser-native: No extra software – all modern browsers support CORS
- Preflight caching: Preflight responses can be cached to reduce overhead
Disadvantages
- Common source of bugs: Wrong CORS setup is a frequent cause of issues
- Extra latency: Preflight doubles HTTP requests for non-simple requests
- Browser-only: CORS does not protect server-to-server calls – not a replacement for API auth
- Wildcard limits: Access-Control-Allow-Origin: * cannot be used with credentials
Frequently Asked Questions about CORS
Why do I get a CORS error even though my server responds correctly?
Often the server does not send the correct Access-Control-Allow-Origin – or only for GET, not for the OPTIONS preflight. In DevTools → Network check the preflight (OPTIONS) response headers. Other causes: missing headers in Access-Control-Allow-Headers or a redirect that drops the CORS headers.
Is CORS a security risk?
CORS itself is a security mechanism, not a vulnerability. A too-permissive config (e.g. Access-Control-Allow-Origin: * with sensitive data) can create risk. Only allow origins that actually need access and use credentials only when necessary.
How do I configure CORS in Node.js/Express?
Easiest with the cors package: app.use(cors({ origin: 'https://your-domain.com', credentials: true })). For multiple origins: origin: ['https://app.firma.de', 'https://admin.firma.de']. For fine-grained control use a callback that checks the origin against a whitelist.
Direct next steps
If you want to apply or evaluate CORS in a real project, start with these transactional pages:
CORS in the Context of Modern IT Projects
This page provides a concise definition of CORS, practical use cases and best practices at a glance — everything you need to evaluate the technology for your next project. CORS falls within the domain of Security and plays a significant role across a wide range of IT projects. When evaluating whether CORS is the right fit, organizations should look beyond the technical merits and consider factors such as existing team expertise, current infrastructure, long-term maintainability, and total cost of ownership.
Drawing on our experience from over 250 software projects, we have found that correctly positioning a technology or methodology within the broader project context often matters more than its isolated strengths.
At Groenewold IT Solutions, we have worked with CORS across multiple client engagements and understand both its advantages and the typical challenges that arise during adoption. If you are unsure whether CORS suits your particular requirements, we are happy to provide an honest, no-obligation assessment. We analyze your specific situation and recommend the approach that delivers the most value — even if that means suggesting an alternative solution.
For more terms in the area of Security and related topics, see our IT Glossary. For concrete applications, costs, and processes we recommend our service pages and topic pages — there you will find many of the concepts explained here put into practice.
Related Terms
Want to use CORS in your project?
We are happy to advise you on CORS and find the optimal solution for your requirements. Benefit from our experience across over 200 projects.