Definition
A browser security mechanism that controls which domains can make requests to your API, preventing unauthorized cross-origin access.
In Depth
CORS uses HTTP headers (Access-Control-Allow-Origin, Access-Control-Allow-Methods, etc.) to declare which origins are permitted. Preflight requests (OPTIONS) check permissions before actual requests. Misconfigured CORS is a common security vulnerability.
Example Usage
Configuring FastAPI CORS middleware to allow requests from purcellanalytics.com while blocking all other origins.
Business Context
Proper CORS configuration is essential for SPAs that make API calls to a different domain. If it is too permissive you're vulnerable, and if it is too restrictive your app breaks.
Related Terms
API Key
A unique identifier used to authenticate and authorize API requests, typically passed as a header or...
Cross-Site Request Forgery
An attack that tricks authenticated users into performing unintended actions on a web application th...
Cross-Site Scripting
A web security vulnerability that allows attackers to inject malicious scripts into web pages viewed...
FastAPI
A modern, high-performance Python web framework for building APIs, with automatic OpenAPI documentat...
Multi-Factor Authentication
A security method requiring two or more verification factors (password + phone code, biometric, hard...
Also Known As
Tags
Quick Info
Need help implementing this in your business?
Get Started