CORS
also: cross-origin resource sharing
The browser rule that a page cannot call a different origin’s API unless that API opts in with the right headers.
CORS (Cross-Origin Resource Sharing) is the browser security mechanism that controls whether JavaScript on one origin may call an API on another. By default the browser blocks cross-origin requests; the server must opt in by returning Access-Control-Allow-Origin and related headers.
Worked example: a frontend at app.example.com calling api.other.com fails until api.other.com responds with Access-Control-Allow-Origin for that origin; for some requests the browser first sends a preflight OPTIONS request to check. Gotcha: CORS is enforced by the BROWSER, not the server — it protects users, not your API (a script or curl ignores it) — so opening it to all origins can expose an API you meant to keep same-origin; it is not an authentication mechanism.