CORS relaxes which security policy for certain resources?

CORS relaxes which security policy for certain resources?

• A. Same-origin policy
• B. Content security policy
• C. Privacy policy
• D. Access control policy

Answer: (A)

Cross-origin access is restricted by the same-origin policy, which prevents a web page from reading data from a different origin. CORS provides a controlled way to relax that restriction for specific resources. When a server wants to allow cross-origin requests, it includes headers like Access-Control-Allow-Origin in its responses, indicating which origins are permitted. For certain types of requests, the browser may perform a preflight check (an OPTIONS request) to verify allowed methods and headers before the actual request is made. If the server approves, the cross-origin request proceeds. The other options don’t fit because Content Security Policy controls what resources a page can fetch or execute (not the cross-origin access itself), privacy policy describes data handling practices, and access control policy is a broader term not the browser mechanism used to enable cross-origin sharing.

Cross-origin access is restricted by the same-origin policy, which prevents a web page from reading data from a different origin. CORS provides a controlled way to relax that restriction for specific resources. When a server wants to allow cross-origin requests, it includes headers like Access-Control-Allow-Origin in its responses, indicating which origins are permitted. For certain types of requests, the browser may perform a preflight check (an OPTIONS request) to verify allowed methods and headers before the actual request is made. If the server approves, the cross-origin request proceeds.

The other options don’t fit because Content Security Policy controls what resources a page can fetch or execute (not the cross-origin access itself), privacy policy describes data handling practices, and access control policy is a broader term not the browser mechanism used to enable cross-origin sharing.