What is CORS, why does the browser block requests, and how do you fix it correctly?
Reviewed by Gurusankar M.
⚡ Short Answer
CORS is a browser security mechanism: by default a page can't read responses from a different origin unless the server sends Access-Control-Allow-Origin (and friends). The browser may send a preflight OPTIONS first. Fix it on the SERVER by allowing the specific origin/methods/headers — not with a wildcard for credentialed requests.
☕Coffee Chat Question
Concept Made Simple
“What is CORS, why does the browser block requests, and how do you fix it correctly?”
🧠Mind Map Answer
Remember It Faster
🔥What If?
Think Beyond the Expected
CORS works in Postman but fails in the browser — why?
CORS is enforced ONLY by browsers — Postman/curl ignore it. The request itself succeeds; the browser blocks the page from READING the response because the server didn't return the right Access-Control-Allow-Origin. The fix is server-side CORS config, not client code.
😂Real World
CORS errors are a daily frontend↔API friction; the fix is always configuring allowed origins/methods/headers on the server (or gateway), and never '*' when cookies/credentials are involved.
🎯Interviewer's Expectation
Keywords they're listening for:
⚠️Common Mistakes
- ✗Trying to fix CORS on the client
- ✗Allow-Origin '*' with credentials
- ✗Forgetting to allow custom headers/methods
✅Best Practices
- ✓Configure CORS server/gateway-side
- ✓Allow specific origins for credentialed requests
- ✓Limit allowed methods/headers to what's needed
🔁Follow-up Questions
- 1What makes a request 'simple' vs 'preflighted'?
- 2Why can't you use '*' with credentials: include?
- 3Where do you configure CORS — app or gateway?
🧩Related Technologies
Continue Learning with AI
Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.
Plain-language foundations
I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner. Topic: Auth (REST APIs) Interview question: "What is CORS, why does the browser block requests, and how do you fix it correctly?" Please: 1. Explain the core idea in simple, plain language, using an everyday analogy. 2. Define any technical terms you use. 3. Walk through one small, concrete example. 4. Finish with a single sentence I can easily remember. Keep the tone friendly and assume I'm new to this topic.
Was this answer helpful?
⭐ Featured Products
Support our platform by exploring our recommended products.
As an Amazon affiliate, purchases through these links may earn us a small commission — at no extra cost to you. It helps keep Full Stack Interview Guru free.