What is CORS and what is it used for?

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that allows restricting web pages' access to resources located on a different domain (origin). It is used to prevent attacks like Cross-Site Request Forgery (CSRF) and other types of cross-site requests that could lead to data leaks or unwanted actions.

When a browser makes a request to a resource on another domain, the server must explicitly permit such access by sending special headers (e.g., Access-Control-Allow-Origin). If such permissions are not present, the browser blocks the response.

An example of a header that allows access from any domain:

Access-Control-Allow-Origin: *

Thus, CORS provides control over which external sites can access your server's resources.