ASP.NET Core Web API Interview Question #141

What is CORS and why is it not an API security mechanism by itself?

Error Handling, Logging, Caching, Rate Limiting, CORS & Reliability Senior Advanced

Quick Interview Answer

CORS controls whether browser JavaScript from one origin is permitted to read responses from another origin. It is enforced by browsers and is important for frontend integration.

Detailed Explanation

CORS controls whether browser JavaScript from one origin is permitted to read responses from another origin. It is enforced by browsers and is important for frontend integration.

CORS does not stop non-browser tools, scripts, or servers from sending HTTP requests to an API. Authentication, authorization, validation, and network security must protect the actual resource.

Code Example

builder.Services.AddCors(options =>
{
    options.AddPolicy("Frontend", policy =>
        policy.WithOrigins("https://app.example.com")
              .AllowAnyHeader()
              .AllowAnyMethod());
});