Beginner LevelREST APIs & Web Services
What is Cross-Origin Resource Sharing (CORS) and how do preflight OPTIONS requests work?
❓ Interview Prompt: Explain CORS browser security model, Same-Origin Policy, preflight `OPTIONS` requests, and response headers (`Access-Control-Allow-Origin`).
CORS is a browser security mechanism that restricts web applications running at one origin (domain/protocol/port) from making API requests to a different origin:
Simple vs Preflight Requests:
•
Simple Requests ('GET', 'HEAD', 'POST' with standard headers): Sent directly; browser verifies 'Access-Control-Allow-Origin' response header.
•
Preflight Requests: For requests using non-standard headers ('Authorization'), custom methods ('PUT'/'DELETE'), or 'application/json', the browser sends an automatic 'OPTIONS' preflight request first to check server permissions!
Code Implementation Example
http
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400💡Preflight OPTIONS HTTP response headers granting cross-origin permissions.
🎯 Interview Key Takeaway
CORS is enforced by browsers; preflight OPTIONS requests verify server cross-origin permission headers before sending actual requests.
#CORS#Security#Preflight#Beginner
Back to all REST APIs & Web Services Questions→