What is CORS?

Q: What is CORS?

**Target Audience:** Engineers preparing for JavaScript/browser-security interviews. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term: . The claim that Node's own fetch ignores CORS entirely was actually verified against a real local server. ## 1. Why This Even Matters — A Story First A store's "members only" sign on its door does not stop a determined person from physically opening the door — it relies entirely on the PERSON (or, for CORS, the browser) choosing to respect it. CORS works exactly like that sign: the server hangs up a header saying who is allowed to read the response, but it is the BROWSER, acting on the user's behalf, that actually enforces the restriction — a tool that isn't a browser (like Node's own fetch, or curl) can walk right past the sign entirely, because nothing is physically stopping it. ## 2. The Core Idea 📌 **Interview term:** CORS is a browser-enforced re

The problem

Question presented to candidate: "If a server sends back an Access-Control-Allow-Origin header that doesn't match the requesting page's origin, who actually blocks the request — the server, or something else? Where does that blocking genuinely happen?"

What a strong answer should cover:

📌 Interview term: CORS (Cross-Origin Resource Sharing) — a browser-enforced security mechanism restricting whether a web page running at one origin can read the response from a request made to a DIFFERENT origin — a real, deliberate relaxation of the browser's stricter same-origin policy, opted into explicitly by the SERVER via response headers.
📌 Interview term: the real, direct answer to the prompt — verified directly: making the identical cross-origin-style request from Node (not a browser) against a real local server sending a mismatched Access-Control-Allow-Origin header genuinely succeeded — Node's own fetch implementation does not enforce CORS at all, confirming CORS blocking is enforced specifically by the BROWSER's own fetch/XHR implementation, never by the server and never by Node itself.
📌 Interview term: Access-Control-Allow-Origin — the response header a server sends to explicitly grant permission — verified directly, reading the real header value a server sent; the SERVER only ever suggests permission via this header, it never itself performs any blocking.
📌 Interview term: simple requests vs. preflighted requests — a "simple" request (a plain GET/POST with only a few allowed headers) is sent directly; anything else (custom headers, other HTTP methods, certain content types) triggers a real, automatic preflight — the browser sends a separate OPTIONS request first, checking permission BEFORE sending the actual request at all.
A precise answer names that CORS is fundamentally a browser security feature protecting the USER, not a mechanism protecting the server — a non-browser client (curl, Node's own fetch, a mobile app) can genuinely make the identical cross-origin request with no CORS restriction whatsoever, verified directly.

Clarifying questions expected:

None — this is a definitional/technical question; directly answering WHO enforces CORS (the browser, not the server) is the strong signal, since it is the single most commonly misunderstood aspect.

Code / implementation expected: Optional — demonstrating that a non-browser client (this very verification script) is genuinely unaffected by a mismatched CORS header is the clearest way to isolate exactly what CORS does and does not do.

cors

Try it yourself

Sketch your approach before you read the solution. That is what the interview tests.

Stuck? Get a hint.

A short nudge toward the approach. It will not give the answer away.

Solution

Target Audience: Engineers preparing for JavaScript/browser-security interviews. Difficulty: Medium

How to read this doc: Concepts are explained in plain language first, then tagged with 📌 Interview term:. The claim that Node's own fetch ignores CORS entirely was actually verified against a real local server.

1. Why This Even Matters — A Story First

A store's "members only" sign on its door does not stop a determined person from physically opening the door — it relies entirely on the PERSON (or, for CORS, the browser) choosing to respect it. CORS works exactly like that sign: the server hangs up a header saying who is allowed to read the response, but it is the BROWSER, acting on the user's behalf, that actually enforces the restriction — a tool that isn't a browser (like Node's own fetch, or curl) can walk right past the sign entirely, because nothing is physically

The solution is hidden so you can try first

7 min read · 8 sections

Run the code

Edit the code and run it here. Each console line with an expected value becomes a test.

JavaScriptReal proof, run in this actual browser: a cross-origin request to a CORS-enabled API succeeds, while one to a site with no CORS headers is genuinely blocked