CORS

Problem

You visit: evil.example JavaScript there tries to read: https://bank.com/account Your browser may already have credentials for the bank. Web applications need control over which origins can read responses.

Solution — CORS

Servers declare which browser origins may access their resources. Access-Control-Allow-Origin: https://trusted.example

Core idea: CORS controls cross-origin access by browser-based code.