# cors Published articles for cors. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How to add AuthKit to a Next.js app DevFeed: [How to add AuthKit to a Next.js app]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-02T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Tutorial](), [Authentication](), [Next.js](), [SDKs]() Tags: [auth](), [authentication](), [callback](), [cors](), [email-verification](), [how-to](), [mfa](), [next-js](), [sdk](), [tutorial]() ### AI overview This tutorial explains how to add WorkOS AuthKit to a Next.js app using either an AI-powered CLI installer or a manual integration. It covers hosted sign-in, session handling, redirect configuration, and validating the build. ### Source excerpt Go from no auth to a full hosted sign-in flow, either in one command or step by step. ## A Starlette middleware guide for FastAPI and Python developers DevFeed: [A Starlette middleware guide for FastAPI and Python developers]() Original publisher: [Read original article]() Author: Aditya Raj Published: 2026-08-28T07:00:00Z Content type: tutorial Language: en Sources: [Honeybadger]() Topics: [FastAPI](), [Python](), [ASGI](), [web applications](), [Cross-origin resource sharing (CORS)]() Tags: [auth](), [cors](), [developers](), [fastapi](), [guide](), [logging](), [middleware](), [python](), [python-articles](), [starlette](), [web-applications]() ### AI overview This guide explains how middleware works in Starlette and FastAPI applications. It covers built-in middleware, custom middleware using pure ASGI and BaseHTTPMiddleware, and execution order when multiple middleware layers process requests and responses. ### Source excerpt Starlette middlewares let you apply logging, auth, and CORS across every route in a web app without duplicating code. This article covers Starlette's built-in middlewares, building custom ones with pure ASGI and BaseHTTPMiddleware, and the execution-order rules that keep your FastAPI applications secure and fast. Read on to learn how to build and order Starlette middlewares the right way. ## How to Use Svelte and Go to Build a Video Chat App DevFeed: [How to Use Svelte and Go to Build a Video Chat App]() Original publisher: [Read original article]() Author: Donal Toomey Published: 2026-08-28T00:00:00Z Content type: tutorial Language: en Sources: [Twilio Blog]() Topics: [Svelte](), [Go Language](), [Vite](), [REST API](), [Single-page application (SPA)](), [Back end](), [Front end]() Tags: [api](), [build-video-app](), [build-video-chat-app](), [cors](), [developer-insights](), [env-file-security](), [environment-variables](), [git](), [go](), [how-can-i-build-a-video-app](), [how-to](), [how-to-create-video-chat-app](), [how-to-make-video-chat-app](), [live-video-chat-app](), [node-js](), [npm](), [real-time](), [svelte](), [twilio-golang](), [twilio-programmable-video](), [twilio-video](), [twilio-video-tutorial](), [video-api](), [video-app](), [video-chat-app](), [vite]() ### AI overview This tutorial explains how to build a real-time video chat app using Svelte for the frontend, Go for the backend, and the Twilio Video API. It covers the application flow, project setup, dependencies, environment configuration, and credential handling. ### Source excerpt Build a real-time video chat app with Svelte 5, Vite, and Go using the Twilio Video API. ## Starlette vs FastAPI: what FastAPI actually adds DevFeed: [Starlette vs FastAPI: what FastAPI actually adds]() Original publisher: [Read original article]() Author: Farhan Hasin Chowdhury Published: 2026-07-20T07:00:00Z Content type: comparison Language: en Sources: [Honeybadger]() Topics: [FastAPI](), [Pydantic](), [ASGI](), [OpenAPI Specification](), [Dependency injection](), [Python](), [WebSocket](), [Cross-origin resource sharing (CORS)]() Tags: [cors](), [data-validation](), [dependency-injection](), [fastapi](), [frameworks](), [openapi](), [python](), [python-articles](), [starlette](), [websocket]() ### AI overview This comparison explains how FastAPI builds on Starlette and Pydantic. Starlette provides the ASGI-based HTTP layer, while Pydantic handles typed data validation; FastAPI adds type-driven parameter parsing, dependency injection, and automatic OpenAPI documentation. It also discusses when using raw Starlette may be preferable. ### Source excerpt FastAPI is built on Starlette, but most developers never look at what's underneath. Learn what FastAPI actually adds on top of Starlette and Pydantic, what comes straight from Starlette, and when dropping down to raw Starlette makes more sense than pulling in the full stack. ## Keycloak 26.6.3 released DevFeed: [Keycloak 26.6.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-04T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Cross-origin resource sharing (CORS)](), [LDAP](), [saml](), [WebAuthn](), [Netty]() Tags: [cors](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.6.3 is released with security fixes and other resolved weaknesses, including issues affecting OIDC, CORS, access control, LDAP federation, SAML, WebAuthn, and token handling. The article directs users to the Keycloak downloads and migration guide. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui #47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc #48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services #48709 [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api #48805 CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization #49118 [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc #49133 [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn #49174 [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions #49175 [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering #49426 [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc #49428 [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml #49431 [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations #49433 [CVE-2026-9803] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api #49434 [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap #49435 [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc #49436 [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc Weaknesses #48978 UNSAFE_PATH ## Building a REST API With Express Framework and MongoDB DevFeed: [Building a REST API With Express Framework and MongoDB]() Original publisher: [Read original article]() Author: Nic Raboy Published: 2026-05-08T12:00:00Z Content type: tutorial Language: en Sources: [Nic Raboy]() Topics: [Express](), [MongoDB](), [REST API](), [Tutorial](), [Node.js](), [JavaScript](), [Cross-origin resource sharing (CORS)](), [.env](), [JSON]() Tags: [api](), [code](), [cors](), [database](), [development](), [express](), [javascript](), [json](), [mongodb](), [node-js](), [nosql](), [rest](), [rest-api](), [tutorial]() ### AI overview A tutorial on building a REST API with Express Framework, MongoDB, and Node.js. It explains how JSON flows between clients, application logic, and MongoDB, then covers prerequisites, dependencies, CORS, environment configuration, and project structure. ### Source excerpt Almost every modern web application will need a REST API for the frontend to communicate with, and in almost every scenario, that frontend is going to expect to work with JSON data. As a result, the b... The post Building a REST API With Express Framework and MongoDB appeared first on Hevo. ## Keycloak 26.5.0 released DevFeed: [Keycloak 26.5.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-01-06T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authorization](), [JSON Web Tokens](), [Model Context Protocol](), [OpenTelemetry](), [Kubernetes](), [Cross-origin resource sharing (CORS)]() Tags: [authorization](), [cors](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [kubernetes](), [ldap](), [model-context-protocol](), [oauth](), [oauth-2-0](), [openid-connect](), [opentelemetry](), [release](), [saml](), [sso]() ### AI overview Keycloak 26.5.0 introduces workflows for realm administration, JWT Authorization Grants in preview, additional documentation for using Keycloak as an authorization server for MCP servers, Kubernetes service-account-token authentication, and OpenTelemetry support for metrics and logging. It also includes CORS enhancements and other identity-management changes. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: Workflows to automate administrative tasks and process within a realm. JWT Authorization Grants, our recommended alternative to external to internal token exchange. Guide for using Keycloak as an authorization server for Model Context Protocol (MCP) servers. Authenticating clients with Kubernetes service account tokens to avoid static client secrets. OpenTelemetry support for metrics and logging, combining all observability information in this popular standard. Read on to learn more about each new feature. If you are upgrading from a previous release, review also the changes listed in the upgrading guide. Security and Standards JWT Authorization Grant (preview) Keycloak 26.5 introduces a new feature called JWT Authorization Grant, which adds support for RFC 7523 to use external signed JWT assertions to request OAuth 2.0 access tokens. To accept signed JWT assertions, a trust relationship must be established between the external provider and Keycloak. This trust relationship can be configured through an identity provider in a dedicated section of the OpenID Connect v1.0 identity provider, or through the new JWT Authorization Grant identity provider. JWT Authorization Grant is recommended as an alternative to External to internal token exchange V1. This feature is in preview, and additional details are available in the dedicated documentation. Using Keycloak as an authorization server for Model Context Protocol (MCP) servers Using Keycloak as an authorization server for Model Context Protocol (MCP) servers is becoming popular, so this release ships additional documentation on how to do this. See Integrating with Model Context Protocol (MCP) for the new guide. Many thanks to Takashi Norimatsu for the contribution. CORS enhancements CORS (Cross Origin Resource Sharing) is a browser security feat ## Reducing Infrastructure Complexity: Why I Ditched S3+CloudFront+Lambda DevFeed: [Reducing Infrastructure Complexity: Why I Ditched S3+CloudFront+Lambda]() Original publisher: [Read original article]() Author: Shivam Anand Published: 2025-08-24T07:48:09Z Content type: opinion Language: en Sources: [Shivam Anand - DevOps & Cloud Engineering Blog]() Topics: [Amazon S3](), [migration](), [Optimization](), [Image](), [Cross-origin resource sharing (CORS)]() Tags: [api-keys](), [aws](), [aws-s3](), [blog-performance](), [cloud-infrastructure](), [cloudfront](), [cloudinary](), [cors](), [devops](), [devops-cloud-infrastructure](), [iam](), [image](), [image-transformations](), [lambda](), [lambda-edge](), [media-optimization](), [migration](), [optimization](), [performance](), [strapi]() ### AI overview The author describes migrating a blog's media management from AWS S3, CloudFront, and Lambda to Cloudinary after finding the multi-service setup unnecessarily complex for a small blog. They highlight Cloudinary's simpler onboarding and URL-based image transformations. ### Source excerpt Discover how I simplified media management for my blog by moving from AWS S3, CloudFront, and Lambda to Cloudinary. Learn about URL-based transformations, automatic optimization, and faster performance. ## Simplify development with public ports in Firebase Studio DevFeed: [Simplify development with public ports in Firebase Studio]() Original publisher: [Read original article]() Author: Chandra Sekhar Pydi Published: 2025-07-01T00:00:00Z Content type: tutorial Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [Development](), [Back end](), [Front end](), [Express](), [Node.js](), [React](), [web applications](), [Web](), [Cross-origin resource sharing (CORS)]() Tags: [backend](), [cors](), [development](), [express](), [firebase](), [firebase-studio](), [frontend](), [full-stack-development](), [javascript](), [node-js](), [react](), [tutorials](), [updates](), [web]() ### AI overview This tutorial explains how Firebase Studio public ports expose backend services and web application previews for sharing, frontend integration, feedback, and testing. It describes opening a backend port, accessing its generated public URL, and making an application preview public. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Stealing HttpOnly cookies with the cookie sandwich technique DevFeed: [Stealing HttpOnly cookies with the cookie sandwich technique]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2025-01-22T14:45:11Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [vulnerability](), [Exploit](), [Chrome](), [Cross-origin resource sharing (CORS)](), [browser](), [Web]() Tags: [browser](), [chrome](), [cors](), [vulnerability](), [web](), [xss]() ### AI overview This security research describes the "cookie sandwich" technique, which abuses legacy cookie parsing, quoted values, and browser behavior to bypass the HttpOnly flag on certain servers. By manipulating cookie structure, reflected parameters, analytics identifiers, CORS requests with credentials, or same-origin XSS, an attacker may expose sensitive HttpOnly cookie values to client-side scripts. ### Source excerpt In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie ## Learning full stack - Implementation details DevFeed: [Learning full stack - Implementation details]() Original publisher: [Read original article]() Author: info@jeroenmols.com (Jeroen Mols) Published: 2024-11-14T00:00:00Z Content type: tutorial Language: en Sources: [Jeroen Mols]() Topics: [Full Stack Development](), [implementation](), [API](), [Development](), [Go Language](), [Authentication](), [Cross-origin resource sharing (CORS)](), [in-memory database](), [Authorization](), [HTTP](), [JSON]() Tags: [api](), [authentication](), [authorization](), [backend](), [blogs](), [cors](), [development](), [frontend](), [full-stack](), [full-stack-development](), [go](), [http](), [implementation](), [in-memory-database](), [json](), [side-project]() ### AI overview The final part of a full-stack development series explains the implementation of a to-do list project. It covers REST API design, authentication and CORS middleware, Go backend structure and routing, and an in-memory database serialized as JSON. ### Source excerpt To conclude my series on full-stack development, this part will look at the implementation, design choices, what worked well and what didn't. This builds on the to-do list project proposed in part 1 and the tech stack described in part 2. ## Spring Security Architecture Explained DevFeed: [Spring Security Architecture Explained]() Original publisher: [Read original article]() Author: Nelson Djalo Published: 2024-10-17T16:58:10Z Content type: article Language: en Sources: [Amigoscode Newsletter]() Topics: [Spring Boot](), [Architecture & Design](), [Security](), [Authentication](), [Authorization](), [JSON Web Tokens]() Tags: [architecture](), [authentication](), [authorization](), [cors](), [jwt](), [security](), [spring](), [spring-boot]() ### AI overview This article explains the architecture of Spring Security in Spring Boot applications. It describes how the Security Filter Chain, AuthenticationManager, Authentication Providers, UserDetailsService, and PasswordEncoder work together to authenticate users and authorize access, including username/password, JWT, OAuth2, and custom authentication methods. ### Source excerpt Unlocking the Layers of Security in Spring Boot Applications ## API Development Roadmap For Developers DevFeed: [API Development Roadmap For Developers]() Original publisher: [Read original article]() Author: Nelson Djalo Published: 2024-08-21T16:36:02Z Content type: tutorial Language: en Sources: [Amigoscode Newsletter]() Topics: [API](), [Development](), [HTTP](), [Caching](), [Cross-origin resource sharing (CORS)](), [GraphQL](), [gRPC](), [Microservices]() Tags: [api](), [caching](), [cors](), [developers](), [graphql](), [guide](), [http](), [microservices](), [rest]() ### AI overview A roadmap for learning API development, covering API fundamentals, HTTP protocols and methods, status codes, headers, cookies, CORS, caching, API styles, and RESTful API design. ### Source excerpt Complete Guide to Mastering API Development ## Fetch and Render GitHub Markdown without CORS DevFeed: [Fetch and Render GitHub Markdown without CORS]() Original publisher: [Read original article]() Author: Sam Edwards Published: 2024-05-02T16:55:50Z Content type: tutorial Language: en Sources: [Handstand Sam]() Topics: [Cross-origin resource sharing (CORS)](), [GitHub](), [GitHub API](), [Markdown](), [Front end](), [Web Development]() Tags: [api](), [cors](), [frontend](), [github](), [javascript](), [markdown](), [security](), [security-vulnerabilities](), [web]() ### AI overview A tutorial on embedding a GitHub project's README on another website from a frontend-only page. It explains why iframes and direct cross-origin fetching fail, then explores the GitHub API, JSONP, Base64 decoding, and rendering the retrieved content. ### Source excerpt I wanted to embed the contents of my GitHub project on another website, but the path to get there wasn't straightforward. Here are the roadblocks I hit, and how I got around them. Skip to the end if you just want the final solution. Idea 1: Render in an iframe I'd love to just create [...] ## Keycloak 23.0.4 released DevFeed: [Keycloak 23.0.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-01-08T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [WebAuthn](), [OpenID connect (OIDC)](), [Cross-origin resource sharing (CORS)](), [Deadlock](), [Parsing](), [passwords]() Tags: [cors](), [deadlock](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [oidc](), [openid-connect](), [parsing](), [password](), [release](), [saml](), [sso](), [ui]() ### AI overview Keycloak 23.0.4 was released on January 8, 2024. The release provides download and upgrade guidance and lists resolved issues affecting WebAuthn tests, remote session preloading, offline sessions, password visibility styling, administrative APIs, CORS, user-profile scopes, CI label parsing, OIDC logout tokens, and Catalan HTML email links. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #9693 PubKeySignRegisterTest failures in WebAuthn tests testsuite #24508 Deadlock when pre-loading remote sessions from external Infinispan storage #24763 Remove sign out action for offline sessions admin/ui #25016 Make password visibility css classes configurable for themes login/ui #25096 Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups admin/api #25111 RealmAdminResource.getGroupByPathGroup does not work with space in path parameter admin/api #25120 CORS issue in 'openid-connect/certs' endpoint oidc #25475 User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect user-profile #25633 Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword ci #25753 Backchannel logout token is missing the "exp" claim oidc #25878 HTML emails in Catalan don't contain links translations ## How To Set Up a GraphQL API Server in Node.js DevFeed: [How To Set Up a GraphQL API Server in Node.js]() Original publisher: [Read original article]() Author: hello@taniarascia.com Published: 2022-06-13T00:00:00Z Content type: tutorial Language: en Sources: [Tania Rascia]() Topics: [GraphQL](), [Node.js](), [Express](), [API](), [middleware](), [Code]() Tags: [api](), [api-server](), [cors](), [express](), [graphql](), [how-to](), [node](), [node-js](), [resolver](), [rest]() ### AI overview This tutorial explains how to build a GraphQL API server with Express and Node.js. It covers defining a GraphQL schema with queries, mutations, and resolver functions, then exploring and debugging the API with GraphiQL. ### Source excerpt In An Introduction to GraphQL, you learned that GraphQL is an open-source query language and runtime for APIs created to solve issues that... ## Apollo Router: our new high-performance Federation runtime is now available in open preview DevFeed: [Apollo Router: our new high-performance Federation runtime is now available in open preview]() Original publisher: [Read original article]() Author: Vivek Ravishankar Published: 2022-03-24T13:02:31Z Content type: release Language: en Sources: [Apollo Blog]() Topics: [GraphQL](), [gateway](), [Rust]() Tags: [apollo](), [backend](), [benchmarks](), [config](), [configuration](), [cors](), [graphql](), [logging](), [native](), [open](), [opentelemetry](), [performance](), [preview](), [release](), [yaml]() ### AI overview Apollo Router, a high-performance Federation runtime written in Rust, moves from alpha to open preview. It offers an alternative to Apollo Gateway for federated supergraphs, with support for Federation 1 and Federation 2, standalone deployment, expanded configuration, plugins, scripting, and Apollo Studio integrations. ### Source excerpt At last year's GraphQL Summit we announced the alpha release of Apollo Router for the first time - our new, high-performance Federation runtime written in Rust. Today, we're excited to bring Apollo Router out of Alpha and into an open preview! What does the Apollo Router preview mean for you? If you're currently running a federated supergraph with Apollo Gateway, Apollo Router gives you a leaner, high-performance runtime option for Federation (both Federation 1 and Federation 2!). ## Creating a Reverse Proxy for Partytown with AWS Cloudfront DevFeed: [Creating a Reverse Proxy for Partytown with AWS Cloudfront]() Original publisher: [Read original article]() Author: andrew@nystudio107.com (Andrew Welch) Published: 2022-02-18T15:49:00Z Content type: tutorial Language: en Sources: [nystudio107 | Articles on modern web development.]() Topics: [Amazon Web Services](), [proxy](), [Cross-origin resource sharing (CORS)](), [JavaScript](), [Library]() Tags: [aws](), [cloudfront](), [cors](), [create](), [easily](), [insights](), [javascript](), [learn](), [library](), [party](), [partytown](), [performance](), [performantly](), [proxy](), [quickly](), [reverse](), [reverse-proxy](), [scripts](), [third-party](), [tracking](), [worker]() ### AI overview A tutorial on creating an AWS CloudFront reverse proxy for Partytown so third-party tracking scripts can run in a web worker. It explains that some scripts require a reverse proxy because their origins do not provide permissive CORS headers. ### Source excerpt Learn how to quickly & easily create a reverse proxy with AWS Cloudfront for Partytown, so your third party tracking scripts can run performantly in a web worker ## What are CORS proxies, and when are they safe? DevFeed: [What are CORS proxies, and when are they safe?]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-04-01T09:30:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Cross-origin resource sharing (CORS)](), [Security](), [browser]() Tags: [browser](), [cors](), [security]() ### AI overview This tutorial explains how CORS proxies bypass browser security restrictions and examines the security risks they can create. It describes how CORS protects credentials, private network addresses, and responses from unauthorized cross-origin requests. ### Source excerpt CORS can be complicated. If you're struggling with it, you might discover the concept of a 'CORS proxy' that promises to solve this, like cors-anywhere or one of the many 'free CORS proxy' hosted services. CORS proxies let you bypass the security restrictions that CORS applies, with just a tiny change of URL. That feels convenient, but turning off security feels dangerous. How do CORS proxies work, and what real-world security problems can they create? Why is CORS a problem? For a typical CORS request: You serve some content to your user via your origin (let's say https://home.example). Your content includes JavaScript, which makes a request to another origin (let's say https://other.example). The browser now needs to make a request from the user's machine to that other host. Browsers are very cautious about doing that last step, for two main reasons. First, browsers often have credentials (e.g. cookies) linked to each domain, and one website shouldn't be able to make requests which might use your credentials & sessions for an unrelated domain. Random sites on the internet shouldn't be able to make requests to your bank's servers with your session cookies. Second, the target server might be private, an internal network address like 10.0.0.1, localhost, or a remote server that only allows requests from certain IP addresses. These servers wouldn't normally be accessibly from the public internet, and remote websites shouldn't be able to make requests to them just by bouncing the request through your browser. Both of these are important security protections for end users who (quite reasonably) want to visit websites without losing control of either their online banking or their home router. To protect against this, browsers send CORS headers in requests (and sometimes a CORS preflight request, before the real request) to check that the server is happy to accept the request and share the contents of the response. If the target server isn't aware of CORS, or doesn't want ## How CORS preflight caching can reduce browser latency and server requests DevFeed: [How CORS preflight caching can reduce browser latency and server requests]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-02-17T17:00:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Cross-origin resource sharing (CORS)](), [Caching](), [API](), [Serverless](), [browser]() Tags: [api](), [backend](), [browser](), [cache](), [caching](), [cors](), [latency](), [performance](), [request](), [serverless]() ### AI overview This tutorial explains how browser CORS preflight requests work and why their default caching behavior can add latency, server load, and costs, especially for serverless APIs. It discusses which cross-origin requests trigger preflights and how caching can reduce repeated OPTIONS requests. ### Source excerpt CORS is a necessity for many APIs, but basic configurations can create a huge number of extra requests, slowing down every browser API client, and sending unnecessary traffic to your backend. This can be a problem with a traditional API, but becomes a much larger issue with serverless platforms, where your billing is often directly tied to the number of requests received, so this can easily double your API costs. All of this is unnecessary: it's happening because you don't know how caching works for CORS requests. Let's fix that. What are CORS preflight requests? Before your browser makes any request that crosses origins (e.g. example.com to api.example.com) if it's not a simple request then the browser sends a preflight request first, and waits for a successful response before it sends the real request. This preflight request is an OPTIONS request to the server, describing the request the browser wants to send, and asking permission first. It looks something like: OPTIONS /v1/documents Host: https://api.example.com Origin: https://example.com Access-Control-Request-Method: PUT Access-Control-Request-Headers: origin, x-requested-with The server has to respond with headers that confirm it's happy to accept the request, and the browser will wait to send the real request until this happens. If you want to check exactly how these CORS rules work, and how you should respond, play around with Will it CORS? to test out the possibilities. In practice, almost all cross-origin API requests will require these preflight requests, notably including: Any request with a JSON or XML body Any request including credentials Any request that isn't GET, POST or HEAD Any exchange that streams the request or response body Use of any headers other than Accept, Accept-Language, Content-Language and Content-Type Why is this bad? Each of these requests blocks your real request for at least the round-trip time to your server. OPTIONS requests aren't cacheable by default, so your CDN won't usua ## How to Debug CORS Errors in JavaScript DevFeed: [How to Debug CORS Errors in JavaScript]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2020-10-07T14:30:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Cross-origin resource sharing (CORS)](), [JavaScript](), [browser](), [Web Development]() Tags: [browser](), [cors](), [debug](), [debugging](), [errors](), [fetch](), [how-to](), [javascript]() ### AI overview This tutorial explains how to recognize and debug CORS errors in JavaScript. It describes browser same-origin protections, common preflight and response-header errors, and the security risks CORS helps prevent. ### Source excerpt Your request is hitting an error due to CORS. Not all is lost! Most CORS errors are quick & easy to debug and fix, once you understand the basics. Let's sort it out. You know you're hitting a CORS error when you see error messages like: Access to fetch at 'https://example.com' from origin 'http://localhost:8000' has been blocked by CORS policy. No 'Access-Control-Allow-Origin' header is present on the requested resource Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://example.com/ Response to preflight request doesn't pass access control check The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include' Method PUT is not allowed by Access-Control-Allow-Methods in preflight response. Request header field custom is not allowed by Access-Control-Allow-Headers in preflight response. In each of these cases, you've asked JavaScript running in your page to send a request to a different origin, and at some stage the browser is refusing to do what you want. What is CORS? When you include JavaScript in a web page, you're running code on your user's computer, inside their browsing session. That's a lot of power, and browsers are designed to protect users from the risks of this. CORS is one of these protections, aiming to protect the user and the services they use from two main attacks: CORS stops you from using the user's existing login session (their cookies and other cached authentication details) when communicating with other servers. JavaScript on your web page shouldn't be able to send requests to the Facebook API using their existing Facebook session. Without CORS, any web page could talk to other servers as you. CORS stops you from talking to servers that might only be accessible from their machine, but which aren't accessible publicly. Your web page should not be able to send requests to my-intranet-server.local, which might be an ## How to Debug Node.js Segmentation Faults DevFeed: [How to Debug Node.js Segmentation Faults]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2020-08-12T11:20:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Node.js](), [debug](), [JavaScript](), [Processes](), [Code]() Tags: [cors](), [crash](), [debug](), [exception](), [how-to](), [js](), [linux](), [memory](), [memory-management](), [node](), [node-js](), [process]() ### AI overview A practical guide to understanding and debugging Node.js segmentation faults. It explains that segfaults occur when a process violates operating-system memory-access rules, often involving invalid memory addresses, pointers, buffer or stack overflows, and native code such as native addons. ### Source excerpt Oh no, your JavaScript code isn't just throwing an exception or crashing: it's segfaulting. What does that mean, and how can you fix it? You'll know this happens because node will hard crash, exiting silently without any kind of real stack trace, perhaps printing just segmentation fault (core dumped). (If you do get a normal JavaScript stack trace on the other hand, then you're dealing with a normal JS error, not a segfault. Lucky you! You might be more interested in the guide on How to Debug Anything) What is a Segmentation Fault? A segmentation fault occurs when a program attempts to access a memory location that it is not allowed to access, or attempts to access a memory location in a way that is not allowed (for example, attempting to write to a read-only location, or to overwrite part of the operating system). - wikipedia.org/wiki/Segmentation_fault In practice, a segfault occurs when your program breaks some fundamental rule set by the operating system. In that case, the operating system sends your process a signal (SIGSEGV on Mac & Linux, STATUS_ACCESS_VIOLATION on Windows), and typically the process shuts down immediately. The rules that you can break to cause this include things like reading or writing to an invalid memory address (e.g. native code somewhere trying to use a null pointer as a memory address), causing a stack or buffer overflow, or reading or writing from memory that's not yours (maybe it was yours but it's now been released, maybe it's unused, or maybe it's owned by another process or the operating system). All of these cases involve low-level concerns, like pointers & memory management. You shouldn't normally have to worry about this when writing JavaScript! The language runtime normally manages your memory, doesn't expose the kinds of APIs that could cause these issues, and enforces its own rules on the APIs that are available, to guarantee that your code behaves correctly. That all ensures that the underlying operating system's rules are ## Chrome 79+ no longer shows preflight CORS requests DevFeed: [Chrome 79+ no longer shows preflight CORS requests]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2020-02-13T16:25:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Cross-origin resource sharing (CORS)](), [Chrome](), [Developer Tools](), [Security]() Tags: [browser](), [browsers](), [chrome](), [cors](), [developer-tools](), [security]() ### AI overview Chrome 79 changes how CORS is implemented and removes CORS preflight OPTIONS requests from the Chrome developer tools Network tab. The article explains CORS preflight behavior and notes that the change moves CORS handling out of the core Blink browser engine, with security and debugging implications. ### Source excerpt Chrome 79 brings some important changes in its CORS implementation, rolling out now, which mean that CORS preflight OPTIONS requests will no longer appear in the network tab of the Chrome developer tools. CORS? Cross-Origin Resource Sharing (CORS) allows web servers to tell browsers which web applications are allowed to talk to them. This applies when a web application tries to send a request to a server with a different origin, for example a page hosted at https://example.com tries to make a request to https://api.mybank.com. For simple requests that are defined to not cause side effects, the browser will make the request, but examine the Access-Control-* headers on the response from the server before allowing the web application to read that data. For more dangerous requests, which could trigger an action on the server, the browser sends a so-called "preflight" request. Before sending the real request, it sends an OPTIONS request to the server that includes Access-Control-Request-* headers describing the method and any restricted headers that the application would like to send. The server then responds with a response including its own Access-Control-* headers, which tell the browser whether or not this is allowed. If it's allowed, the browser goes on to send the real request, if not then the application isn't allowed to make that request, so it fails. Phew, make sense? This is just an outline of CORS, there's quite a bit more detail available in MDN's docs. It trips up quite a few people, and checking that you've done it securely on the server side (i.e. you're not allowing other malicious web applications to do or read things they shouldn't) is harder still. Changes in Chrome 79 In Chrome 79, a new flag was added: If you're running 79+, you can see this on the chrome://flags page. It appears that this was disabled by default at the release in December 2019, but it's intended to be enabled incrementally over the weeks from January 6th 2020, which brings us to app ## Cross-Origin Messaging for Embedded Browser Components DevFeed: [Cross-Origin Messaging for Embedded Browser Components]() Original publisher: [Read original article]() Author: Shai Almog Published: 2019-06-17T00:00:00Z Content type: tutorial Language: en Sources: [CodeName One]() Topics: [Cross-origin resource sharing (CORS)](), [web applications](), [JavaScript](), [browser]() Tags: [browser](), [cors](), [javascript]() ### AI overview The article explains how the same-origin policy and CORS affect communication with an embedded browser component from another domain. It describes using message sending and a web-page message event listener to enable communication between the two origins. ### Source excerpt BrowserComponent is a pretty powerful tool when you just want to integrate HTML into your application. We use it a lot in native apps, but surprisingly it's just as useful when we compile an app as a web application. It lets us embed HTML into the web application. But there's a big caveat known as SOP when we do that. SOP and CORS SOP is the "Same Origin Policy" enforced by browsers. It prevents CSRF (Cross Site Request Forgery) which essentially lets a site pretend it's a different site. [Next page]()