MediumExperience level: 3-5 years1 min read

What is CORS, why does the browser block requests, and how do you fix it correctly?

Reviewed by Gurusankar M.

Asked inAmazonCognizantAccentureWipro
#cors#preflight#same-origin#browser security#options
Report issue

Short Answer

CORS is a browser security mechanism: by default a page can't read responses from a different origin unless the server sends Access-Control-Allow-Origin (and friends). The browser may send a preflight OPTIONS first. Fix it on the SERVER by allowing the specific origin/methods/headers — not with a wildcard for credentialed requests.

On this page

Concept Made Simple

Coffee Chat Question

“What is CORS, why does the browser block requests, and how do you fix it correctly?”

Remember It Faster

Mind Map Answer

Why
browser same-origin policy
Preflight
OPTIONS for non-simple requests
Fix
server: Access-Control-Allow-* headers
Credentials
no '*' with cookies — name the origin

Think Beyond the Expected

What If?

CORS works in Postman but fails in the browser — why?

CORS is enforced ONLY by browsers — Postman/curl ignore it. The request itself succeeds; the browser blocks the page from READING the response because the server didn't return the right Access-Control-Allow-Origin. The fix is server-side CORS config, not client code.

Real World

CORS errors are a daily frontend↔API friction; the fix is always configuring allowed origins/methods/headers on the server (or gateway), and never '*' when cookies/credentials are involved.

Interviewer's Expectation

Keywords they're listening for:

  • browser same-origin policy
  • preflight OPTIONS
  • server-side Allow-* headers
  • no wildcard with credentials
  • not enforced outside browsers

Common Mistakes

  • Trying to fix CORS on the client
  • Allow-Origin '*' with credentials
  • Forgetting to allow custom headers/methods

Best Practices

  • Configure CORS server/gateway-side
  • Allow specific origins for credentialed requests
  • Limit allowed methods/headers to what's needed

Follow-up Questions

  1. What makes a request 'simple' vs 'preflighted'?
  2. Why can't you use '*' with credentials: include?
  3. Where do you configure CORS — app or gateway?

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: Auth (REST APIs)
Interview question: "What is CORS, why does the browser block requests, and how do you fix it correctly?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Affiliate links

Tools for Your Developer Workspace

Equipment for a comfortable, productive setup.

As an Amazon Associate I earn from qualifying purchases.