What does cross-origin resource sharing (CORS) allow browsers to do?

What does cross-origin resource sharing (CORS) allow browsers to do?

• A. Override the same-origin policy for specific resources
• B. Block all cross-origin requests by default
• C. Encrypt cross-origin requests
• D. Require authentication for cross-origin requests

Answer: (A)

CORS lets the browser relax the same-origin policy for certain cross-origin requests when the server explicitly allows it. In practice, this means a server can opt in to let a web page from another origin access its resources by sending headers like Access-Control-Allow-Origin. The browser may also perform a preflight check using an OPTIONS request for some non-simple requests before granting access. This mechanism does not apply to all cross-origin requests automatically, only to those the server has permitted. It isn’t about encrypting traffic (that’s TLS/HTTPS) and it doesn’t inherently require authentication for access—the server’s response may or may not require credentials. So the best description is that it allows browsers to override the same-origin policy for specific resources.

CORS lets the browser relax the same-origin policy for certain cross-origin requests when the server explicitly allows it. In practice, this means a server can opt in to let a web page from another origin access its resources by sending headers like Access-Control-Allow-Origin. The browser may also perform a preflight check using an OPTIONS request for some non-simple requests before granting access. This mechanism does not apply to all cross-origin requests automatically, only to those the server has permitted. It isn’t about encrypting traffic (that’s TLS/HTTPS) and it doesn’t inherently require authentication for access—the server’s response may or may not require credentials. So the best description is that it allows browsers to override the same-origin policy for specific resources.