WEBVTT

00:00:00.000 --> 00:00:06.000
Why can a browser report a CORS error for an API request?

00:00:06.000 --> 00:00:13.000
CORS headers help determine whether a page can access a cross-origin response.

00:00:13.000 --> 00:00:18.000
Check the browser, the origins and the server response.
6 CORS basics.

00:00:18.000 --> 00:00:30.000
Identify the page origin
The scheme, host and port determine an origin.
Scheme · Host · Port

00:00:30.000 --> 00:00:42.000
Compare the destination
A different origin can require cross-origin access permission.
Page origin · Resource origin · Cross-origin request

00:00:42.000 --> 00:00:54.000
The browser checks access
Browser rules restrict scripts reading responses across origins.
Frontend script · Browser enforcement · Response access

00:00:54.000 --> 00:01:06.000
The server supplies headers
The resource server indicates which origins may access its response.
Response headers · Allowed origin · Relevant resource

00:01:06.000 --> 00:01:18.000
Some requests are preflighted
The browser may first ask whether the intended method and headers are allowed.
Preflight request · Intended method · Intended headers

00:01:18.000 --> 00:01:30.000
Diagnose the exact exchange
Review the error, origin and server configuration with the developer.
Browser error · Actual response · Intended access policy

00:01:30.000 --> 00:01:39.000
Your checklist
Identify the page origin · Compare the destination · The browser checks access · The server supplies headers · Some requests are preflighted · Diagnose the exact exchange

00:01:39.000 --> 00:01:47.000
Investigate the actual origin and response rather than disabling browser protections.
jerseyweb.je