What is the difference between CORS and the Same-Origin Policy?

What is the difference between CORS and the Same-Origin Policy?

CORS, or Cross-Origin Resource Sharing, is a security feature that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. The Same-Origin Policy, on the other hand, is a security measure that prevents scripts on one origin from interacting with resources from another origin.

Why is the Same-Origin Policy important?

The Same-Origin Policy is crucial for web security as it helps to prevent malicious attacks, such as Cross-Site Scripting (XSS) and data theft, by restricting how documents or scripts from one origin can interact with resources from another origin.

How does CORS work in practice?

CORS works by using HTTP headers to tell the browser whether to allow a web page to make requests to a different domain. When a request is made, the browser checks the response headers to see if the requested resource is allowed to be accessed.

Can you give an example of a CORS request?

Sure! For example, if a web application hosted on 'example.com' wants to fetch data from 'api.example.org', it will send a request with an 'Origin' header. If 'api.example.org' allows requests from 'example.com', it will respond with the appropriate CORS headers, allowing the browser to process the response.