What is CORS (Cross-Origin Resource Sharing)?

By default a browser stops a page on one site from reading responses from another site. CORS is how your server tells the browser which outside origins it is willing to allow, using headers such as Access-Control-Allow-Origin.

AI tools often hit a CORS error during development and fix it by allowing every origin, sometimes together with credentials. That can let any website make authenticated requests to your API on behalf of a logged-in visitor and read the answers. The opposite mistake is thinking CORS is your API's lock. It is not: a command-line request ignores CORS entirely, so anyone can call an unprotected endpoint directly.

Allow only the exact origins that need access, never reflect the incoming origin back blindly, and keep real protection in authentication and authorization on the server. Treat CORS as a browser-side courtesy, not access control.