What is the difference between CORS and the Same-Origin Policy?

What is the difference between CORS and the Same-Origin Policy?

CORS, or Cross-Origin Resource Sharing, is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. The Same-Origin Policy, on the other hand, is a security measure that restricts how a document or script loaded from one origin can interact with resources from another origin.

Why is the Same-Origin Policy important?

The Same-Origin Policy is crucial for web security as it prevents malicious scripts on one site from accessing sensitive data on another site, thus protecting user information and maintaining privacy.

How does CORS work in practice?

CORS works by using HTTP headers to tell the browser to allow web applications running at one origin to access resources from a different origin. When a request is made, the server can respond with specific headers indicating whether the request is allowed.

Can you give an example of a CORS request?

Sure! For example, if a web application at 'https://example.com' wants to fetch data from 'https://api.example.org', the browser will send a preflight request to check if the server at 'api.example.org' allows requests from 'example.com'.