개발공부 기록지

Certainly! CORS stands for Cross-Origin Resource Sharing. It is a security feature implemented in web browsers to manage how web applications running at one origin (domain) can request resources from another origin.

Here's a breakdown of its key aspects:

1. Same-Origin Policy: By default, web browsers enforce a security measure called the Same-Origin Policy (SOP). This policy restricts web pages from making requests to a different domain than the one that served the web page. Its primary purpose is to protect user data and prevent malicious scripts on one page from obtaining access to sensitive data on another.
2. The Need for CORS: Sometimes, legitimate web applications need to make cross-origin requests. For example, a web application hosted on example.com might need to request resources from api.example.com or a third-party API hosted on a different domain. CORS provides a way to allow these cross-origin requests safely.
3. How CORS Works: CORS works through HTTP headers.
   • When a web application makes a cross-origin request, the browser sends an HTTP request to the target server with an `Origin` header, indicating the origin of the request.
   • The server can then decide whether to allow or deny the request based on its CORS policy. If the server allows the request, it responds with specific CORS headers, like `Access-Control-Allow-Origin`, indicating which origins are permitted.
   • This header lists the allowed origns or a wildcard to indicagte that any origins is allowed.
4. Simple and Preflight Requests: There are two types of CORS requests - Simple and Preflight. Simple requests are basic requests like GET or POST with certain safe headers, and they are sent directly with CORS headers. Preflight requests are more complex and use methods like PUT or DELETE, or include custom headers. These are first sent with an OPTIONS request to check if the actual request is safe to send.
5. Security and Limitations: While CORS enables cross-origin requests, it also includes mechanisms to ensure security. It doesn't allow arbitrary sharing of user credentials like cookies or HTTP authentication unless explicitly permitted by the server. Also, CORS policies are set server-side, meaning the server has full control over who can access its resources.

In summary, CORS is an essential part of modern web security. It enables controlled cross-origin requests, balancing the need for functionality with the need to protect users' data and privacy.

Simple Example

GET /data HTTP/1.1
Host: api.website-b.com
Origin: https://websites-a.com

HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://website-a.com
Content-Type: application/json

{
	"data" : "sample data"
}