What is CORS and how does it work?

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that restricts web pages from making requests to resources on another domain (origin).

When a web page tries to make a request (e.g., AJAX) to a different domain, the browser sends a preflight OPTIONS request to check if the server allows such a request.

If the server's response includes headers that permit requests from this origin (e.g., Access-Control-Allow-Origin), the browser proceeds with the main request.

Thus, CORS protects users from malicious requests but also allows legitimate data exchange between different domains if the server explicitly permits it.