CORS cheatsheet

All about cors.

This cheatsheet is inspired by the book "CORS in Action" by Monsu Hossain

Introducing CORS

CORS - cross origin resource sharing

CORS is a way of making HTTP requests from one place to another. This is a trivial thing in other programming languages, but not so much in client-side JavaScript. This cheatsheet makes it a bit easier.

• making CORS request

  • xmlhttprequest object
  • xmlhttprequest events
  • xmlhttprequest response properties
  • response headers
  • cookies
  • List of headers that can't be set by setRequestHeader

• handling CORS request

  • the access-control-allow-origin header
  • handling preflight requests
  • cookies
  • exposing response headers to the client
  • redirects
  • debugging

• sample server

  npm i

  npm start

• best practices

  • security
  • cookies
  • csrf
  • handling preflight request

Lifecycle of a CORS request

1. The client initiates the request.
2. The browser adds additional information to the request and forwards it to the server.
3. The server decides how to respond to the request, and sends the response to the browser.
4. The browser decides whether the client should have access to the response, and either passes the response to the client or returns an error.