Browsers calling other origins.
WHAT THE RULE IS
A browser will not let a page read a response from a different origin unless permitted.
WHAT AN ORIGIN IS
The scheme, host and port together.
WHY THE RULE EXISTS
Without it, any page could read data from any service you are signed into.
WHAT THAT MAKES CLEAR
It protects the user, not your server.
WHAT IT IS NOT
A security control for your interface.
WHY THAT MATTERS
Anything not a browser ignores it entirely.
WHAT THE SERVER MUST SEND
A header naming permitted origins.
WHAT A PREFLIGHT REQUEST IS
A preliminary request asking whether the real one is permitted.
WHAT TRIGGERS ONE
Methods beyond the simple ones, or custom headers.
WHAT THE SERVER MUST ANSWER
Permitted origins, methods and headers.
WHAT TO NEVER DO
Permit all origins on an interface using credentials.
WHY
It is exactly the situation the rule prevents.
WHAT TO DO INSTEAD
List the origins explicitly.
WHAT THE COMMONEST CONFUSION IS
Treating a browser error as a server fault.
WHY IT IS CONFUSING
The request usually succeeded; the browser refused to hand over the response.
HOW TO CONFIRM
Make the same call from the command line.
WHAT TO CHECK IF IT WORKS THERE
The headers, not the logic.
