CORS (Cross-Origin Resource Sharing)

Cross-Origin Resource Sharing (CORS) is the browser mechanism that permits or blocks JavaScript access to responses from another origin, depending on the server’s HTTP headers and request context. An origin combines scheme, host, and port. A website can request resources from a different origin, but the browser may restrict whether its script can read the response when the required CORS permissions are absent.

For example, an appointment website hosted at one domain may call an API at another. The API can respond with Access-Control-Allow-Origin identifying which requesting origins may read its data. Some requests require a browser preflight OPTIONS exchange that checks permitted methods or headers before the actual request. Credentialed cross-origin requests cannot use the wildcard origin in the relevant response header.

CORS is not an authentication system, a firewall, or a blanket barrier against server-to-server requests. A public API still needs authorization and input validation where appropriate. A permissive CORS configuration can expose sensitive responses to untrusted websites when paired with other mistakes, but denying CORS does not make an endpoint private. Website owners typically encounter CORS when adding third-party booking widgets or cross-domain APIs. Resolve it by correctly defining trusted origins and server permissions, not by disabling browser security features for visitors.