What is CORS and why does it exist?

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that blocks JavaScript from reading responses issued by a different origin than the page that loaded the script. It exists so a malicious site cannot use a user's logged-in session on another site to read their data.

Why does my API work in Postman but fail in the browser with CORS?

Because Postman is not a browser — it ignores CORS. The browser is the only client that enforces CORS. If your API works in Postman but fails in the browser, the server is not sending the right CORS headers for the browser to allow the response.

What is a CORS preflight request?

Before certain cross-origin requests, the browser sends an OPTIONS request to ask the server if the actual request is allowed. This happens for any request with custom headers, non-standard content types, or methods other than GET, HEAD, or POST. The server must respond with the allowed methods and headers.

Should I use Access-Control-Allow-Origin: * in production?

Only for public APIs that do not use cookies or Authorization headers. For any API that requires credentials, you must specify the exact origin. Using a wildcard with credentials is rejected by the browser.

August 14, 2026·3 min read

CORS — The Mental Model They Never Taught You

CORS is the most copy-pasted topic in web dev. Everyone adds Access-Control-Allow-Origin: * until it works. Here's what's actually happening under the hood.

CORSWeb DevSecurityBackend

CORS is the most copy-pasted topic in web dev. Your frontend hits an API, you see "CORS error" in the console, you Google it, you add Access-Control-Allow-Origin: *, it works, you move on. You never actually learned what CORS does.

This is the article that explains it. Read it once and you'll debug CORS in two minutes instead of two hours.

The mental model: the browser is the enforcer

The biggest misconception: people think CORS is a server feature. It's not. It's a browser feature.

← Back to blog