Glossary of Security Terms: CORS

CORS (Cross-Origin Resource Sharing) is a system, consisting of transmitting , that determines whether browsers block frontend JavaScript code from accessing responses for cross-origin requests.

The forbids cross-origin access to resources. But CORS gives web servers the ability to say they want to opt into allowing cross-origin access to their resources.

Learn more

General knowledge

• on MDN
• on Wikipedia

CORS headers

Indicates whether the response can be shared.

Indicates whether or not the response to the request can be exposed when the credentials flag is true.

Used in response to a preflight request to indicate which HTTP headers can be used when making the actual request.

Specifies the method or methods allowed when accessing the resource in response to a preflight request.

Indicates which headers can be exposed as part of the response by listing their names.

Indicates how long the results of a preflight request can be cached.

Used when issuing a preflight request to let the server know which HTTP headers will be used when the actual request is made.

Used when issuing a preflight request to let the server know which will be used when the actual request is made.

Indicates where a fetch originates from.

Technical reference

View Previous Terms:

• Block cipher mode of operation
• Certificate authority
• Challenge-response authen tication
• Cipher
• Cipher suite
• Ciphertext
• CORS-safelisted request header
• CORS-safelisted response header
• Cross-site scripting
• Cryptanalysis
• Cryptographic hash function
• Cryptography
• CSP
• CSRF
• Decryption
• Digital certificate
• DTLS (Datagram Transport Layer Security)
• Encryption
• Forbidden header name
• Forbidden response header name
• Hash
• HMAC
• HPKP
• HSTS
• HTTPS
• Key
• MitM
• OWASP
• Preflight request
• Public-key cryptography
• Reporting directive
• Robots.txt
• Same-origin policy
• Session Hijacking
• SQL Injection
• Symmetric-key cryptography
• TOFU
• Transport Layer Security (TLS)

Credits

• Source:
• Published under Open CC Attribution ShareAlike 3.0 license