Cross-Origin Resource Sharing (CORS)

Cross-Origin Resource Sharing (CORS) is an HTTP-header mechanism that lets a server indicate any origins other than its own from which a browser should permit loading resources, relaxing the same-origin policy for APIs such as fetch() and XMLHttpRequest. For requests that can cause side effects — methods other than GET, or POST with certain MIME types — the specification mandates that browsers preflight the request: they send an HTTP OPTIONS request soliciting supported methods from the server and, upon approval, send the actual request. Servers use response headers to declare which origins are allowed and whether user credentials such as cookies and HTTP authentication should accompany requests; when making credentialed requests to a different domain, third-party cookie policies still apply. CORS also governs resources such as web fonts, WebGL textures, and images drawn into a canvas with drawImage(). When a CORS check fails the browser raises an error, but for security reasons the specifics of the failure are not available to JavaScript. Scope: Web security. Reviewed October 4, 2026.