CyberGuard dictionary / Web Application Security
CORS
Cross-Origin Resource Sharing (CORS) is a browser mechanism that lets a server state which other origins may read its responses.
In simple terms
A site can choose whether JavaScript from a different website may read a response in a user's browser.
Technical explanation
CORS uses response headers and sometimes a preflight request to relax the same-origin policy. Credentialed access requires careful origin selection; CORS does not authenticate callers and does not restrict direct non-browser requests.
The browser evaluates CORS headers when a script tries to read cross-origin responses. A permissive origin rule combined with credentials can expose data, while non-browser clients are unaffected by the browser rule.
Examples in practice
An API allows a trusted application origin to read customer data but rejects a browser script from an unrelated origin.
A customer portal API allows its exact frontend origin with credentials. A security review removes a rule that reflected any requesting origin and tests the response headers.
Why it matters
Overly broad origin rules can let untrusted pages read responses that were meant for a trusted site.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.