11h • Notes 📝
CORS cross origin resource shairing
Day -4 of learning Web Dev
#Backend-Engineering Day-4
→ In simple setups everything comes from one origin (one server), so their was no issue of trust for the browser.
→ In modern setups we have separate servers for frontend and backend, which makes the browser to treat them as different places
→ When the frontend tries to talk to the backend, the browser blocks the request by default
→ Here confusion comes that we control both sides, but the browser doesn’t know that.
→The browser here cares about protection from dangerous websites,
→ The browser decides what is same or different origins using protocol, domain, and port.Even a small change like a different port makes the browser think it’s a new origin,
→because of this, the browser assumes cross-origin requests maybe dangerous
→ for safety purposes ,the browser applies a strict rule that blocks cross-origin access. This safety rule is called the Same Origin Policy
→ CORS exists only to handle this rule among the trusted origins.
→ The real problem happens when the backend does not clearly tell the browser that the frontend is allowed
→ The browser only listens when permission is given through special HTTP headers.These permission headers and rules together are called CORS
→ CORS is enforced by the browser itself, which is why tools like Postman work without issues.
→ Express fixes the problem by adding CORS early using middleware
→ Sometimes the browser sends an OPTIONS request first to ask what is allowed. After getting clear permission, the browser allows the real request to go through,
→Access-Control-Allow-Origin tells the browser who is allowed to talk to the backend.
#Day4 #WebDev #BackendEngineering #HTTP #CORS #HTTPS #APIs #SoftwareLearning #CodingJourney #DevLife
3
3 comments
CORS cross origin resource shairing
powered by
skool.com/make-1k-5k-in-30-days-8449
Media Valley School is the fastest way to hit $1K/month with freelancing or agency work. Guaranteed.
Land your first $1K month in 30 days
Suggested communities
Powered by