What does CORS stand for?
- "Cross-Origin Resource Sharing" - a way to share restricted info from one domain to another domain
Why is it necessary?
- It allows you to specify who can access your endpoint on the server side.
Why is this important for the Capstone?
- I think this will be especially important if we create our own API for our capstone project - Security will continue to become more and more of a priority as the apps we develop get more complicated.
CORS (Cross-Origin Resource Sharing) is an HTTP header that allows servers to indicate what other origins than it’s own have permission to load its resources. The origin is defined by the hostname (domain), scheme (protocol), and port of the URL used to access it.
CORS is actually a direct response to the Same-Origin Policy which is a security mechanism that restricts how a document/script loaded by one origin can interact with a resource from another origin. Although this is not as secure as authentication/authorization, you can think of it as an additional layer of security that helps prevent malicious attacks on your website. If you didn’t have the same origin policy in place, you could have facebook open in one tab and then go to another site and be able to access all of your private information. Same thing if you had a tab open with your bank info.
CORS is something you will need to enable in your capstone project so that the FE & BE can talk to each other. It is something the BE will need to incorporate so that the FE can talk with and access data from the BE server. There are various packages/gems out there in all languages including JS, Rails, and Python, that allow you to enable CORS by adding an “allow list” containing which domains may have access to your data. If you’re interested in reading up more in CORS, definitely check out the MDN docs!
