CORS, finally explained

The rule

Browsers block cross-origin XHR/fetch unless the server explicitly allows it via headers.

The headers

• Access-Control-Allow-Origin — the calling origin.
• Access-Control-Allow-Credentials — set true to allow cookies.
• Access-Control-Allow-Methods — list of allowed verbs.
• Access-Control-Allow-Headers — list of allowed custom headers.

Preflight

Browsers send an OPTIONS request first for any “non-simple” request. The server must respond 200 with the right headers, or the real request never fires.

Cookies

Allow-Credentials: true + Allow-Origin MUST be a specific origin (not *).