What tasks does the CORS mechanism solve when browsers interact with a server?

The CORS (Cross-Origin Resource Sharing) mechanism addresses security issues when browsers interact with servers by restricting web pages from accessing resources located on a different domain.

By default, browsers block requests from one domain to another (same-origin policy) to prevent attacks like CSRF and XSS.

CORS allows the server to explicitly specify which domains can access its resources through special HTTP headers, such as:

• Access-Control-Allow-Origin — permits access from specified domains.
• Access-Control-Allow-Methods — allowed HTTP methods.
• Access-Control-Allow-Headers — allowed headers.

For example, if the frontend at https://example.com makes a request to an API at https://api.example.org, the API server should include in its response the header:

Access-Control-Allow-Origin: https://example.com

Otherwise, the browser will block the response.

Thus, CORS provides controlled and secure data exchange between different sources in web applications.