CORS

Code

# Preflight request
OPTIONS /api/data HTTP/1.1
Host: api.example.com
Origin: https://app.example.com
Access-Control-Request-Method: PUT
Access-Control-Request-Headers: Content-Type

---

# Preflight response
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400

---

# Actual response with credentials
HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true

Explanation

CORS lets a browser relax the same-origin policy so a page can call APIs on another origin. For non-simple requests the browser sends a preflight OPTIONS request, and the server replies with the allowed methods, headers, and origin. When credentials are involved, Allow-Origin cannot be a wildcard and Allow-Credentials must be true.

More HTTP Snippets