Please note, this is a STATIC archive of website developer.mozilla.org from 03 Nov 2016, cach3.com does not collect or store any user information, there is no "phishing" involved.

Revision 1129581 of CORS

  • Revision slug: Glossary/CORS
  • Revision title: CORS
  • Revision id: 1129581
  • Created:
  • Creator: fscholz
  • Is current revision? No
  • Comment update
Tags: 

Revision Content

CORS (Cross-Origin Resource Sharing) is a system that determines whether to block or fulfill requests for restricted resources on a web page from another domain outside the domain from which the resource originated.

The same-origin security policy forbids "cross-domain" requests by default, CORS gives web servers cross-domain access controls, which enable secure cross-domain data transfers.

Learn more

General knowledge

CORS headers

{{HTTPHeader("Access-Control-Allow-Origin")}}
Indicates whether the response can be shared.
{{HTTPHeader("Access-Control-Allow-Credentials")}}
Indicates whether or not the response to the request can be exposed when the credentials flag is true.
{{HTTPHeader("Access-Control-Allow-Headers")}}
Used in response to a preflight request to indicate which HTTP headers can be used when making the actual request.
{{HTTPHeader("Access-Control-Allow-Methods")}}
Specifies the method or methods allowed when accessing the resource in response to a preflight request.
{{HTTPHeader("Access-Control-Expose-Headers")}}
Indicates which headers can be exposed as part of the response by listing their names.
{{HTTPHeader("Access-Control-Max-Age")}}
Indicates how long the results of a preflight request can be cached.
{{HTTPHeader("Access-Control-Request-Headers")}}
Used when issuing a preflight request to let the server know which HTTP headers will be used when the actual request is made.
{{HTTPHeader("Access-Control-Request-Method")}}
Used when issuing a preflight request to let the server know which HTTP method will be used when the actual request is made.
{{HTTPHeader("Origin")}}
Indicates where a fetch originates from.

Technical reference

Revision Source

 
<p><strong>CORS&nbsp;</strong>(Cross-Origin Resource Sharing) is a system that&nbsp;determines&nbsp;whether to block or fulfill requests for restricted resources on a web page from another domain outside the domain from which the resource originated.</p>

<p>The <a href="/en-US/docs/Web/Security/Same-origin_policy">same-origin security policy</a> forbids "cross-domain" requests by default, CORS gives web servers cross-domain access controls, which enable secure cross-domain data transfers.</p>

<h2 id="Learn_more">Learn more</h2>

<h3 id="General_knowledge">General knowledge</h3>

<ul>
 <li><a href="/en-US/docs/Glossary/CORS">HTTP access control (CORS)</a> on MDN</li>
 <li>{{Interwiki("wikipedia", "Cross-origin resource sharing")}} on Wikipedia</li>
</ul>

<h3>CORS headers</h3>

<dl>
 <dt>{{HTTPHeader("Access-Control-Allow-Origin")}}</dt>
 <dd>Indicates whether the response can be shared.</dd>
 <dt>{{HTTPHeader("Access-Control-Allow-Credentials")}}</dt>
 <dd>Indicates whether or not the response to the request can be exposed when the credentials flag is true.</dd>
 <dt>{{HTTPHeader("Access-Control-Allow-Headers")}}</dt>
 <dd>Used in response to a preflight request to indicate which HTTP&nbsp;headers can be used when making the actual request.</dd>
 <dt>{{HTTPHeader("Access-Control-Allow-Methods")}}</dt>
 <dd>Specifies the method or methods allowed when accessing the resource in response to a preflight request.</dd>
 <dt>{{HTTPHeader("Access-Control-Expose-Headers")}}</dt>
 <dd>Indicates which headers can be exposed as part of the response by listing their names.</dd>
 <dt>{{HTTPHeader("Access-Control-Max-Age")}}</dt>
 <dd>Indicates how long the results of a preflight request can be cached.</dd>
 <dt>{{HTTPHeader("Access-Control-Request-Headers")}}</dt>
 <dd>Used when issuing a preflight request to let the server know which HTTP headers will be used when the actual request is made.</dd>
 <dt>{{HTTPHeader("Access-Control-Request-Method")}}</dt>
 <dd>Used when issuing a preflight request to let the server know which <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods">HTTP method</a> will be used when the actual request is made.</dd>
 <dt>{{HTTPHeader("Origin")}}</dt>
 <dd>Indicates where a fetch originates from.</dd>
</dl>

<h3 id="Technical_reference">Technical reference</h3>

<ul>
 <li><a href="https://fetch.spec.whatwg.org">Fetch specification</a></li>
</ul>
Revert to this revision