CORS

Cross-Origin Resource Sharing - a browser security mechanism that controls which domains can access resources from another domain.

May 1, 2026 / About 1 min read

Security

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls how web pages from one origin (domain, protocol, and port combination) can request resources from a different origin. By default, browsers enforce the same-origin policy, which blocks cross-origin requests. CORS provides a way for servers to explicitly allow specific cross-origin requests.

CORS works through HTTP headers. When a browser makes a cross-origin request, it includes an Origin header. The server responds with Access-Control-Allow-Origin and related headers that specify which origins are permitted. For complex requests, the browser first sends a preflight OPTIONS request to check permissions before sending the actual request.

For URL shortening services, CORS configuration is important for the API endpoints that create and manage short URLs. If the API is called from JavaScript running on a different domain (which is common for embedded shortening widgets), the server must include appropriate CORS headers to allow the request.

Common CORS mistakes include using wildcard (*) for Access-Control-Allow-Origin in production (which prevents sending credentials), not handling preflight requests correctly, and exposing sensitive headers unnecessarily.

Was this article helpful?

Related Terms

CSP

Content Security Policy - an HTTP header that controls which resources a browser is allowed to load for a given page.

XSS

Short for Cross-Site Scripting. An attack technique that injects malicious scripts into web pages to steal users' information.

HTTPS

The secure version of HTTP that encrypts data transmitted between a browser and a web server using TLS.

SQL Injection

An attack that inserts malicious SQL code into application queries through user input fields to manipulate the database.

HSTS

HTTP Strict Transport Security - a header that forces browsers to only connect to a website using HTTPS.

Referrer-Policy

An HTTP header that controls how much referrer information is included when navigating from one page to another.

URL Shortener API Guide - Generating Short URLs Programmatically

A practical guide to using URL shortener APIs. Learn about request formats, response structures, authentication, and implementation patterns.

Self-Hosting a URL Shortener: Full Link Control

Explore the benefits and challenges of running your own URL shortening service. Covers open-source tools, serverless architecture, and cost-performance tips.

Short URL Security - Phishing Risks, Safe Sharing Practices, and Protection Guide

A comprehensive guide to short URL security. Understand phishing risks, malware distribution via shortened links, and best practices for safe sharing.

FAQ

What causes CORS errors?

The browser blocks requests to a different origin (domain, port, or protocol). Setting the Access-Control-Allow-Origin header on the server side resolves this.

What is a CORS preflight request?

It's a verification request sent by the browser using the OPTIONS method before the actual request. It checks which methods and headers the server allows, ensuring security.

Put the terms to work

Shorten a URL for Free