CORS: Cross-domain requests with JavaScript
summary
CORS lets browsers make true cross-origin REST calls (GET/POST/PUT/DELETE) by using a pre-flight OPTIONS handshake and response headers like Access-Control-Allow-Origin. It supports cookies and single-sign on when allow-credentials is enabled, but requires server-side logic (rack-cors, servlet filter or Express middleware) to echo/originate and whitelist hosts and ports. JSONP’s eval-and-GET limitation is avoided, latency from proxy middleware is removed, and this approach reliably works once headers and pre-flights are correct.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:30Integration in the browser
- 1:28but - same origin policy?
- 3:41JSON-P cross domain
- 6:14CORS - client side ex.
- 6:46How it works
- 8:06Security Theatre?
- 8:53Common pattern
- 9:48Middleware
- 10:37Authorization
- 10:55Debugging
- 11:51My Minimal Setup
- 12:09Example (express)
related talks
37mA Hipster History of CORS
41mHow About a Tour of CORS?
26mTalking to Browsers with CORS
25mWe Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS
15mNo, It's Not a CORS Error
52mThe Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery
42mBuilding modular, scalable web apps? of CORS!
52mThe Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery