CORS

Opening Scenario

You build a React app at app.example.com that calls your API at api.example.com. Everything works in Postman. You deploy and open the browser console: Access to fetch at 'https://api.example.com/users' from origin 'https://app.example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present. Your API is running fine — it returned 200. But the browser refused to let your JavaScript read the response. Something is enforcing a rule you didn't write.

---

Question Progression

1. Who is blocking this, and why?

Question: Postman works. curl works. Only the browser is blocking it. The API returned 200. So the server isn't blocking you — something in the browser is. Why does the browser care what origin made the request?

Reasoning: Browsers run untrusted code (JavaScript from any website). If a browser allowed any JavaScript to make cross-origin requests and read the…