CORS (Cross-Origin Resource Sharing)

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls whether a web page from one origin (scheme, domain and port) can request resources from a different origin. By default, browsers block such cross-origin requests from scripts.

A server allows cross-origin access by sending headers such as Access-Control-Allow-Origin. For requests with custom headers or methods like PUT, the browser first sends a preflight OPTIONS request to check permission. CORS errors happen in the browser, so the fix is on the server's response headers, not in the client code.

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT
Access-Control-Allow-Headers: Content-Type, Authorization