An origin is the unique identity of a website, made up of its address and its connection type. Browsers use this identity to decide if a request for data is safe.

The Website Origin

This rule prevents websites from looking at each other's private information by default. It keeps your bank data safe when you happen to visit other, less-trusted websites.

Same-Origin Security Rule

When a browser asks another site for data, it includes a digital label of its own address. This helps the target site know exactly who is asking for information.

The Request Identity

To allow a connection, the target site must send back a specific 'allow' label. If this label is missing, the browser will protect you by blocking the data.

The Permission Label

A site can use a special 'star' symbol to permit every website in the world to see its data. This is common for public items like online maps or fonts.

The All-Access Star

Basic tasks, like asking for a simple webpage or text, happen instantly. The browser sends these requests directly without an extra waiting period.

Simple Data Requests

For more complex requests, the browser sends a quick 'test' message first. It's like asking 'Are you there and is this okay?' before sending the real data.

The Preflight Knock

Normally, your browser won't share your login details or 'cookies' with other websites. You must give special permission for this secret data to be shared across different sites.

Sharing Private Login Info

If you see a 'CORS error,' it means the security guard blocked a request because the target site didn't give permission. This is a safety feature, not a bug.

Common Blocked Errors

This security system only works inside web browsers like Chrome or Safari. Other computer tools can bypass these rules because they aren't meant for human web surfing.

Browsers Versus Other Tools

It allows modern web apps to combine features from many different sources safely. Without it, the web would be much more limited and less connected.

Why Do We Need CORS?