# Cross-origin resource sharing (CORS) Cross-origin resource sharing (CORS) is an HTTP-based protocol that lets servers declare whether responses can be shared with other origins. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## A Starlette middleware guide for FastAPI and Python developers DevFeed: [A Starlette middleware guide for FastAPI and Python developers]() Original publisher: [Read original article]() Author: Aditya Raj Published: 2026-08-28T07:00:00Z Content type: tutorial Language: en Sources: [Honeybadger]() Topics: [FastAPI](), [Python](), [ASGI](), [web applications](), [Cross-origin resource sharing (CORS)]() Tags: [auth](), [cors](), [developers](), [fastapi](), [guide](), [logging](), [middleware](), [python](), [python-articles](), [starlette](), [web-applications]() ### AI overview This guide explains how middleware works in Starlette and FastAPI applications. It covers built-in middleware, custom middleware using pure ASGI and BaseHTTPMiddleware, and execution order when multiple middleware layers process requests and responses. ### Source excerpt Starlette middlewares let you apply logging, auth, and CORS across every route in a web app without duplicating code. This article covers Starlette's built-in middlewares, building custom ones with pure ASGI and BaseHTTPMiddleware, and the execution-order rules that keep your FastAPI applications secure and fast. Read on to learn how to build and order Starlette middlewares the right way. ## Keycloak 26.6.3 released DevFeed: [Keycloak 26.6.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-04T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Cross-origin resource sharing (CORS)](), [LDAP](), [saml](), [WebAuthn](), [Netty]() Tags: [cors](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.6.3 is released with security fixes and other resolved weaknesses, including issues affecting OIDC, CORS, access control, LDAP federation, SAML, WebAuthn, and token handling. The article directs users to the Keycloak downloads and migration guide. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui #47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc #48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services #48709 [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api #48805 CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization #49118 [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc #49133 [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn #49174 [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions #49175 [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering #49426 [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc #49428 [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml #49431 [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations #49433 [CVE-2026-9803] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api #49434 [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap #49435 [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc #49436 [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc Weaknesses #48978 UNSAFE_PATH ## Building a REST API With Express Framework and MongoDB DevFeed: [Building a REST API With Express Framework and MongoDB]() Original publisher: [Read original article]() Author: Nic Raboy Published: 2026-05-08T12:00:00Z Content type: tutorial Language: en Sources: [Nic Raboy]() Topics: [Express](), [MongoDB](), [REST API](), [Tutorial](), [Node.js](), [JavaScript](), [Cross-origin resource sharing (CORS)](), [.env](), [JSON]() Tags: [api](), [code](), [cors](), [database](), [development](), [express](), [javascript](), [json](), [mongodb](), [node-js](), [nosql](), [rest](), [rest-api](), [tutorial]() ### AI overview A tutorial on building a REST API with Express Framework, MongoDB, and Node.js. It explains how JSON flows between clients, application logic, and MongoDB, then covers prerequisites, dependencies, CORS, environment configuration, and project structure. ### Source excerpt Almost every modern web application will need a REST API for the frontend to communicate with, and in almost every scenario, that frontend is going to expect to work with JSON data. As a result, the b... The post Building a REST API With Express Framework and MongoDB appeared first on Hevo. ## Keycloak 26.5.0 released DevFeed: [Keycloak 26.5.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-01-06T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authorization](), [JSON Web Tokens](), [Model Context Protocol](), [OpenTelemetry](), [Kubernetes](), [Cross-origin resource sharing (CORS)]() Tags: [authorization](), [cors](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [kubernetes](), [ldap](), [model-context-protocol](), [oauth](), [oauth-2-0](), [openid-connect](), [opentelemetry](), [release](), [saml](), [sso]() ### AI overview Keycloak 26.5.0 introduces workflows for realm administration, JWT Authorization Grants in preview, additional documentation for using Keycloak as an authorization server for MCP servers, Kubernetes service-account-token authentication, and OpenTelemetry support for metrics and logging. It also includes CORS enhancements and other identity-management changes. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: Workflows to automate administrative tasks and process within a realm. JWT Authorization Grants, our recommended alternative to external to internal token exchange. Guide for using Keycloak as an authorization server for Model Context Protocol (MCP) servers. Authenticating clients with Kubernetes service account tokens to avoid static client secrets. OpenTelemetry support for metrics and logging, combining all observability information in this popular standard. Read on to learn more about each new feature. If you are upgrading from a previous release, review also the changes listed in the upgrading guide. Security and Standards JWT Authorization Grant (preview) Keycloak 26.5 introduces a new feature called JWT Authorization Grant, which adds support for RFC 7523 to use external signed JWT assertions to request OAuth 2.0 access tokens. To accept signed JWT assertions, a trust relationship must be established between the external provider and Keycloak. This trust relationship can be configured through an identity provider in a dedicated section of the OpenID Connect v1.0 identity provider, or through the new JWT Authorization Grant identity provider. JWT Authorization Grant is recommended as an alternative to External to internal token exchange V1. This feature is in preview, and additional details are available in the dedicated documentation. Using Keycloak as an authorization server for Model Context Protocol (MCP) servers Using Keycloak as an authorization server for Model Context Protocol (MCP) servers is becoming popular, so this release ships additional documentation on how to do this. See Integrating with Model Context Protocol (MCP) for the new guide. Many thanks to Takashi Norimatsu for the contribution. CORS enhancements CORS (Cross Origin Resource Sharing) is a browser security feat ## Delegating Java tasks to Supervised AI Dev Pipelines DevFeed: [Delegating Java tasks to Supervised AI Dev Pipelines]() Original publisher: [Read original article]() Author: Juan Antonio Breña Moral Published: 2025-12-22T03:03:48Z Content type: tutorial Language: en Sources: [Java Advent Calendar]() Topics: [cursor](), [AI Agent](), [Artificial Intelligence](), [Automation](), [Frontier Model](), [API](), [Development](), [Cross-origin resource sharing (CORS)](), [GitHub](), [GitLab](), [Hackathon-Kit]() Tags: [2025](), [ai](), [ai-agent](), [api](), [automation](), [cursor](), [dev](), [frontier-model](), [github](), [gitlab](), [jvm](), [pipeline](), [rest]() ### AI overview This tutorial explains how to use Cursor Agent CLI and Cursor Cloud Agents to delegate Java-related software tasks to frontier models. It covers running Cursor Agent CLI in development pipelines, submitting pull requests for review, and using Cursor Cloud Agents through REST endpoints with repositories, prompts, models, and API keys. ### Source excerpt During the second part of this year, Anysphere, the company behind Cursor IDE, released 2 new products that could help you in 2026 increase the level of automation in your software operations. The names of both products are: Cursor Agent CLI and Cursor Cloud Agents. The article will explain the features that both products share [...] The post Delegating Java tasks to Supervised AI Dev Pipelines appeared first on JVM Advent. ## Hosting Bugsink on Coolify DevFeed: [Hosting Bugsink on Coolify]() Original publisher: [Read original article]() Author: Julien Published: 2025-07-07T20:33:23Z Content type: tutorial Language: en Sources: [Thoughts, stories and ideas.]() Topics: [Docker Compose](), [Deployment](), [Docker](), [Cross-origin resource sharing (CORS)]() Tags: [bugsink](), [coolify](), [deployment](), [docker](), [docker-compose](), [environment-variables](), [http](), [https](), [redirection](), [testing]() ### AI overview This tutorial explains how to deploy Bugsink on Coolify with Docker Compose while a Coolify bug prevents the default Bugsink deployment template from working correctly. It covers port redirection, HTTPS, domain configuration, and environment variables. ### Source excerpt A simple Docker Compose setup to host Bugsink using Coolify that supports HTTPS ## Simplify development with public ports in Firebase Studio DevFeed: [Simplify development with public ports in Firebase Studio]() Original publisher: [Read original article]() Author: Chandra Sekhar Pydi Published: 2025-07-01T00:00:00Z Content type: tutorial Language: en Sources: [Firebase Blog]() Topics: [Firebase](), [Development](), [Back end](), [Front end](), [Express](), [Node.js](), [React](), [web applications](), [Web](), [Cross-origin resource sharing (CORS)]() Tags: [backend](), [cors](), [development](), [express](), [firebase](), [firebase-studio](), [frontend](), [full-stack-development](), [javascript](), [node-js](), [react](), [tutorials](), [updates](), [web]() ### AI overview This tutorial explains how Firebase Studio public ports expose backend services and web application previews for sharing, frontend integration, feedback, and testing. It describes opening a backend port, accessing its generated public URL, and making an application preview public. ### Source excerpt News, tutorials, and updates from the Firebase team. ## Stealing HttpOnly cookies with the cookie sandwich technique DevFeed: [Stealing HttpOnly cookies with the cookie sandwich technique]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2025-01-22T14:45:11Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [vulnerability](), [Exploit](), [Chrome](), [Cross-origin resource sharing (CORS)](), [browser](), [Web]() Tags: [browser](), [chrome](), [cors](), [vulnerability](), [web](), [xss]() ### AI overview This security research describes the "cookie sandwich" technique, which abuses legacy cookie parsing, quoted values, and browser behavior to bypass the HttpOnly flag on certain servers. By manipulating cookie structure, reflected parameters, analytics identifiers, CORS requests with credentials, or same-origin XSS, an attacker may expose sensitive HttpOnly cookie values to client-side scripts. ### Source excerpt In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie ## Bypassing WAFs with the phantom $Version cookie DevFeed: [Bypassing WAFs with the phantom $Version cookie]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2024-12-04T15:03:35Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Parsing](), [HTTP](), [Vulnerabilities](), [Cross-origin resource sharing (CORS)](), [Spring Boot](), [Python](), [Flask](), [Django]() Tags: [cookies](), [django](), [flask](), [http](), [parsing](), [python](), [security](), [spring-boot](), [vulnerabilities]() ### AI overview This article explains how differences between HTTP cookie parsers can be exploited to bypass web application firewalls. It examines legacy cookie features such as the phantom $Version attribute, quoted values, and octal escape sequences, with examples from Spring Boot, Apache Tomcat, and Python frameworks including Flask and Django. ### Source excerpt HTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known ## Learning full stack - Implementation details DevFeed: [Learning full stack - Implementation details]() Original publisher: [Read original article]() Author: info@jeroenmols.com (Jeroen Mols) Published: 2024-11-14T00:00:00Z Content type: tutorial Language: en Sources: [Jeroen Mols]() Topics: [Full Stack Development](), [implementation](), [API](), [Development](), [Go Language](), [Authentication](), [Cross-origin resource sharing (CORS)](), [in-memory database](), [Authorization](), [HTTP](), [JSON]() Tags: [api](), [authentication](), [authorization](), [backend](), [blogs](), [cors](), [development](), [frontend](), [full-stack](), [full-stack-development](), [go](), [http](), [implementation](), [in-memory-database](), [json](), [side-project]() ### AI overview The final part of a full-stack development series explains the implementation of a to-do list project. It covers REST API design, authentication and CORS middleware, Go backend structure and routing, and an in-memory database serialized as JSON. ### Source excerpt To conclude my series on full-stack development, this part will look at the implementation, design choices, what worked well and what didn't. This builds on the to-do list project proposed in part 1 and the tech stack described in part 2. ## API Development Roadmap For Developers DevFeed: [API Development Roadmap For Developers]() Original publisher: [Read original article]() Author: Nelson Djalo Published: 2024-08-21T16:36:02Z Content type: tutorial Language: en Sources: [Amigoscode Newsletter]() Topics: [API](), [Development](), [HTTP](), [Caching](), [Cross-origin resource sharing (CORS)](), [GraphQL](), [gRPC](), [Microservices]() Tags: [api](), [caching](), [cors](), [developers](), [graphql](), [guide](), [http](), [microservices](), [rest]() ### AI overview A roadmap for learning API development, covering API fundamentals, HTTP protocols and methods, status codes, headers, cookies, CORS, caching, API styles, and RESTful API design. ### Source excerpt Complete Guide to Mastering API Development ## Introducing Log Drains DevFeed: [Introducing Log Drains]() Original publisher: [Read original article]() Author: Lee TzeYiing Published: 2024-08-15T07:00:00Z Content type: release Language: en Sources: [Supabase Blog]() Topics: [Logging](), [observability pipelines](), [Supabase](), [SIEM, Security](), [observability](), [Self-hosted](), [Cross-origin resource sharing (CORS)](), [backends](), [JSON](), [BigQuery](), [PostgreSQL]() Tags: [analytics](), [bigquery](), [datadog](), [http](), [json](), [logging](), [logs](), [monitoring](), [observability](), [observability-pipelines](), [postgresql](), [product](), [security](), [self-hosted](), [self-hosting]() ### AI overview Supabase introduces Log Drains for Team and Enterprise users, enabling logs from Database, Storage, Realtime, and Auth to be exported to Datadog Logs or custom HTTP endpoints. The feature supports alerting, observability pipelines, SIEM integrations, extended retention, self-hosting, and local development. ### Source excerpt Log Drains for exporting product logs is now available under Public Alpha ## Fetch and Render GitHub Markdown without CORS DevFeed: [Fetch and Render GitHub Markdown without CORS]() Original publisher: [Read original article]() Author: Sam Edwards Published: 2024-05-02T16:55:50Z Content type: tutorial Language: en Sources: [Handstand Sam]() Topics: [Cross-origin resource sharing (CORS)](), [GitHub](), [GitHub API](), [Markdown](), [Front end](), [Web Development]() Tags: [api](), [cors](), [frontend](), [github](), [javascript](), [markdown](), [security](), [security-vulnerabilities](), [web]() ### AI overview A tutorial on embedding a GitHub project's README on another website from a frontend-only page. It explains why iframes and direct cross-origin fetching fail, then explores the GitHub API, JSONP, Base64 decoding, and rendering the retrieved content. ### Source excerpt I wanted to embed the contents of my GitHub project on another website, but the path to get there wasn't straightforward. Here are the roadblocks I hit, and how I got around them. Skip to the end if you just want the final solution. Idea 1: Render in an iframe I'd love to just create [...] ## Keycloak 23.0.4 released DevFeed: [Keycloak 23.0.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-01-08T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [WebAuthn](), [OpenID connect (OIDC)](), [Cross-origin resource sharing (CORS)](), [Deadlock](), [Parsing](), [passwords]() Tags: [cors](), [deadlock](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [oidc](), [openid-connect](), [parsing](), [password](), [release](), [saml](), [sso](), [ui]() ### AI overview Keycloak 23.0.4 was released on January 8, 2024. The release provides download and upgrade guidance and lists resolved issues affecting WebAuthn tests, remote session preloading, offline sessions, password visibility styling, administrative APIs, CORS, user-profile scopes, CI label parsing, OIDC logout tokens, and Catalan HTML email links. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #9693 PubKeySignRegisterTest failures in WebAuthn tests testsuite #24508 Deadlock when pre-loading remote sessions from external Infinispan storage #24763 Remove sign out action for offline sessions admin/ui #25016 Make password visibility css classes configurable for themes login/ui #25096 Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups admin/api #25111 RealmAdminResource.getGroupByPathGroup does not work with space in path parameter admin/api #25120 CORS issue in 'openid-connect/certs' endpoint oidc #25475 User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect user-profile #25633 Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword ci #25753 Backchannel logout token is missing the "exp" claim oidc #25878 HTML emails in Catalan don't contain links translations ## Bunny.net CDN caching flaw exposed authenticated users' private HTTP responses DevFeed: [Bunny.net CDN caching flaw exposed authenticated users' private HTTP responses]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2023-06-20T11:30:00Z Content type: article Language: en Sources: [HTTP Toolkit]() Topics: [Caching](), [HTTP](), [Cross-origin resource sharing (CORS)](), [Authentication](), [web applications]() Tags: [authentication](), [caching](), [cdn](), [http](), [performance](), [protection](), [responses](), [security]() ### AI overview The article examines a Bunny.net CDN caching flaw that caused private HTTP responses intended for one authenticated user to be served to other users. It explains how CDN caching can diverge from HTTP standards and expose private data or authentication credentials, and notes that the issue has been fixed. ### Source excerpt Caching is hard. Unfortunately though, caching is quite important. Hosted caching & CDNs offer incredible powers that can provide amazing performance boosts, cost savings & downtime protection, essential for most modern sites with any serious volume of users. Unfortunately, while there are strict standards for how caching is supposed to work with HTTP on the web, many cache providers do not quite follow these, instead giving their customers free reign over all kinds of invalid caching behaviour, and providing their own default configurations that often don't closely follow these standards to start with either. There are many good reasons for this, but the main one is that CDNs are now doing dual service: providing performance improvements, and actively protecting upstream sites from DoS attacks and traffic spikes (similar problems - the key difference between a DoS attack and hitting #1 on Hacker News etc is intent, not impact). This conflicts with many of the standards, which prioritize correctness and predictability over this use case and, for example, expect clients to be able to unilaterally request that the cache be ignored. Bunny.net provides one of these CDNs, and like most they aggressively cache content beyond the limits of the standards, both to help protect upstream servers and to support advanced user use cases. This has upsides, but in some edge cases can result in awkward bugs and break developer expectations. In some more dramatic cases though, it can expose private user data, break applications & even leak auth credentials, and that's where this story gets serious. A few months ago, I ran into exactly that issue while testing out deployment options with Bunny.net, where I discovered that private HTTP responses intended for one authenticated user could be served to other users instead. Spoiler: this is now fixed! That said, it's worth exploring where this went wrong, the many ways this can work right, and how CDNs solve issues like this in practice. C ## Creating a Reverse Proxy for Partytown with AWS Cloudfront DevFeed: [Creating a Reverse Proxy for Partytown with AWS Cloudfront]() Original publisher: [Read original article]() Author: andrew@nystudio107.com (Andrew Welch) Published: 2022-02-18T15:49:00Z Content type: tutorial Language: en Sources: [nystudio107 | Articles on modern web development.]() Topics: [Amazon Web Services](), [proxy](), [Cross-origin resource sharing (CORS)](), [JavaScript](), [Library]() Tags: [aws](), [cloudfront](), [cors](), [create](), [easily](), [insights](), [javascript](), [learn](), [library](), [party](), [partytown](), [performance](), [performantly](), [proxy](), [quickly](), [reverse](), [reverse-proxy](), [scripts](), [third-party](), [tracking](), [worker]() ### AI overview A tutorial on creating an AWS CloudFront reverse proxy for Partytown so third-party tracking scripts can run in a web worker. It explains that some scripts require a reverse proxy because their origins do not provide permissive CORS headers. ### Source excerpt Learn how to quickly & easily create a reverse proxy with AWS Cloudfront for Partytown, so your third party tracking scripts can run performantly in a web worker ## What are CORS proxies, and when are they safe? DevFeed: [What are CORS proxies, and when are they safe?]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-04-01T09:30:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Cross-origin resource sharing (CORS)](), [Security](), [browser]() Tags: [browser](), [cors](), [security]() ### AI overview This tutorial explains how CORS proxies bypass browser security restrictions and examines the security risks they can create. It describes how CORS protects credentials, private network addresses, and responses from unauthorized cross-origin requests. ### Source excerpt CORS can be complicated. If you're struggling with it, you might discover the concept of a 'CORS proxy' that promises to solve this, like cors-anywhere or one of the many 'free CORS proxy' hosted services. CORS proxies let you bypass the security restrictions that CORS applies, with just a tiny change of URL. That feels convenient, but turning off security feels dangerous. How do CORS proxies work, and what real-world security problems can they create? Why is CORS a problem? For a typical CORS request: You serve some content to your user via your origin (let's say https://home.example). Your content includes JavaScript, which makes a request to another origin (let's say https://other.example). The browser now needs to make a request from the user's machine to that other host. Browsers are very cautious about doing that last step, for two main reasons. First, browsers often have credentials (e.g. cookies) linked to each domain, and one website shouldn't be able to make requests which might use your credentials & sessions for an unrelated domain. Random sites on the internet shouldn't be able to make requests to your bank's servers with your session cookies. Second, the target server might be private, an internal network address like 10.0.0.1, localhost, or a remote server that only allows requests from certain IP addresses. These servers wouldn't normally be accessibly from the public internet, and remote websites shouldn't be able to make requests to them just by bouncing the request through your browser. Both of these are important security protections for end users who (quite reasonably) want to visit websites without losing control of either their online banking or their home router. To protect against this, browsers send CORS headers in requests (and sometimes a CORS preflight request, before the real request) to check that the server is happy to accept the request and share the contents of the response. If the target server isn't aware of CORS, or doesn't want ## How CORS preflight caching can reduce browser latency and server requests DevFeed: [How CORS preflight caching can reduce browser latency and server requests]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-02-17T17:00:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Cross-origin resource sharing (CORS)](), [Caching](), [API](), [Serverless](), [browser]() Tags: [api](), [backend](), [browser](), [cache](), [caching](), [cors](), [latency](), [performance](), [request](), [serverless]() ### AI overview This tutorial explains how browser CORS preflight requests work and why their default caching behavior can add latency, server load, and costs, especially for serverless APIs. It discusses which cross-origin requests trigger preflights and how caching can reduce repeated OPTIONS requests. ### Source excerpt CORS is a necessity for many APIs, but basic configurations can create a huge number of extra requests, slowing down every browser API client, and sending unnecessary traffic to your backend. This can be a problem with a traditional API, but becomes a much larger issue with serverless platforms, where your billing is often directly tied to the number of requests received, so this can easily double your API costs. All of this is unnecessary: it's happening because you don't know how caching works for CORS requests. Let's fix that. What are CORS preflight requests? Before your browser makes any request that crosses origins (e.g. example.com to api.example.com) if it's not a simple request then the browser sends a preflight request first, and waits for a successful response before it sends the real request. This preflight request is an OPTIONS request to the server, describing the request the browser wants to send, and asking permission first. It looks something like: OPTIONS /v1/documents Host: https://api.example.com Origin: https://example.com Access-Control-Request-Method: PUT Access-Control-Request-Headers: origin, x-requested-with The server has to respond with headers that confirm it's happy to accept the request, and the browser will wait to send the real request until this happens. If you want to check exactly how these CORS rules work, and how you should respond, play around with Will it CORS? to test out the possibilities. In practice, almost all cross-origin API requests will require these preflight requests, notably including: Any request with a JSON or XML body Any request including credentials Any request that isn't GET, POST or HEAD Any exchange that streams the request or response body Use of any headers other than Accept, Accept-Language, Content-Language and Content-Type Why is this bad? Each of these requests blocks your real request for at least the round-trip time to your server. OPTIONS requests aren't cacheable by default, so your CDN won't usua ## How to Debug CORS Errors in JavaScript DevFeed: [How to Debug CORS Errors in JavaScript]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2020-10-07T14:30:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Cross-origin resource sharing (CORS)](), [JavaScript](), [browser](), [Web Development]() Tags: [browser](), [cors](), [debug](), [debugging](), [errors](), [fetch](), [how-to](), [javascript]() ### AI overview This tutorial explains how to recognize and debug CORS errors in JavaScript. It describes browser same-origin protections, common preflight and response-header errors, and the security risks CORS helps prevent. ### Source excerpt Your request is hitting an error due to CORS. Not all is lost! Most CORS errors are quick & easy to debug and fix, once you understand the basics. Let's sort it out. You know you're hitting a CORS error when you see error messages like: Access to fetch at 'https://example.com' from origin 'http://localhost:8000' has been blocked by CORS policy. No 'Access-Control-Allow-Origin' header is present on the requested resource Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://example.com/ Response to preflight request doesn't pass access control check The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include' Method PUT is not allowed by Access-Control-Allow-Methods in preflight response. Request header field custom is not allowed by Access-Control-Allow-Headers in preflight response. In each of these cases, you've asked JavaScript running in your page to send a request to a different origin, and at some stage the browser is refusing to do what you want. What is CORS? When you include JavaScript in a web page, you're running code on your user's computer, inside their browsing session. That's a lot of power, and browsers are designed to protect users from the risks of this. CORS is one of these protections, aiming to protect the user and the services they use from two main attacks: CORS stops you from using the user's existing login session (their cookies and other cached authentication details) when communicating with other servers. JavaScript on your web page shouldn't be able to send requests to the Facebook API using their existing Facebook session. Without CORS, any web page could talk to other servers as you. CORS stops you from talking to servers that might only be accessible from their machine, but which aren't accessible publicly. Your web page should not be able to send requests to my-intranet-server.local, which might be an ## Chrome 79+ no longer shows preflight CORS requests DevFeed: [Chrome 79+ no longer shows preflight CORS requests]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2020-02-13T16:25:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Cross-origin resource sharing (CORS)](), [Chrome](), [Developer Tools](), [Security]() Tags: [browser](), [browsers](), [chrome](), [cors](), [developer-tools](), [security]() ### AI overview Chrome 79 changes how CORS is implemented and removes CORS preflight OPTIONS requests from the Chrome developer tools Network tab. The article explains CORS preflight behavior and notes that the change moves CORS handling out of the core Blink browser engine, with security and debugging implications. ### Source excerpt Chrome 79 brings some important changes in its CORS implementation, rolling out now, which mean that CORS preflight OPTIONS requests will no longer appear in the network tab of the Chrome developer tools. CORS? Cross-Origin Resource Sharing (CORS) allows web servers to tell browsers which web applications are allowed to talk to them. This applies when a web application tries to send a request to a server with a different origin, for example a page hosted at https://example.com tries to make a request to https://api.mybank.com. For simple requests that are defined to not cause side effects, the browser will make the request, but examine the Access-Control-* headers on the response from the server before allowing the web application to read that data. For more dangerous requests, which could trigger an action on the server, the browser sends a so-called "preflight" request. Before sending the real request, it sends an OPTIONS request to the server that includes Access-Control-Request-* headers describing the method and any restricted headers that the application would like to send. The server then responds with a response including its own Access-Control-* headers, which tell the browser whether or not this is allowed. If it's allowed, the browser goes on to send the real request, if not then the application isn't allowed to make that request, so it fails. Phew, make sense? This is just an outline of CORS, there's quite a bit more detail available in MDN's docs. It trips up quite a few people, and checking that you've done it securely on the server side (i.e. you're not allowing other malicious web applications to do or read things they shouldn't) is harder still. Changes in Chrome 79 In Chrome 79, a new flag was added: If you're running 79+, you can see this on the chrome://flags page. It appears that this was disabled by default at the release in December 2019, but it's intended to be enabled incrementally over the weeks from January 6th 2020, which brings us to app ## Cross-Origin Messaging for Embedded Browser Components DevFeed: [Cross-Origin Messaging for Embedded Browser Components]() Original publisher: [Read original article]() Author: Shai Almog Published: 2019-06-17T00:00:00Z Content type: tutorial Language: en Sources: [CodeName One]() Topics: [Cross-origin resource sharing (CORS)](), [web applications](), [JavaScript](), [browser]() Tags: [browser](), [cors](), [javascript]() ### AI overview The article explains how the same-origin policy and CORS affect communication with an embedded browser component from another domain. It describes using message sending and a web-page message event listener to enable communication between the two origins. ### Source excerpt BrowserComponent is a pretty powerful tool when you just want to integrate HTML into your application. We use it a lot in native apps, but surprisingly it's just as useful when we compile an app as a web application. It lets us embed HTML into the web application. But there's a big caveat known as SOP when we do that. SOP and CORS SOP is the "Same Origin Policy" enforced by browsers. It prevents CSRF (Cross Site Request Forgery) which essentially lets a site pretend it's a different site. ## Your CORS and API Gateway survival guide DevFeed: [Your CORS and API Gateway survival guide]() Original publisher: [Read original article]() Author: Alex DeBrie Published: 2018-01-16T00:00:00Z Content type: tutorial Language: en Sources: [Serverless Blog]() Topics: [Cross-origin resource sharing (CORS)](), [Amazon API Gateway](), [Serverless](), [Web APIs]() Tags: [api-gateway](), [apis](), [aws](), [aws-lambda](), [cloud-computing](), [cors](), [engineering](), [faas](), [function-as-a-service](), [guide](), [how-to](), [infrastructure-as-code](), [lambda](), [serverless](), [serverless-architecture](), [serverless-framework](), [web-apis]() ### AI overview A guide to the basics of Cross-Origin Resource Sharing (CORS) and avoiding CORS problems with Serverless web APIs on Lambda. ### Source excerpt Get the basics on Cross-Origin Resource Sharing (CORS) and how to avoid problems with your Serverless web APIs on Lambda. ## Configure a proxy for your API calls with Angular CLI DevFeed: [Configure a proxy for your API calls with Angular CLI]() Original publisher: [Read original article]() Published: 2016-11-06T00:00:00Z Content type: tutorial Language: en Sources: [Juri Strumpflohner]() Topics: [Angular CLI](), [Angular](), [API](), [Cross-origin resource sharing (CORS)](), [JavaScript](), [Webpack](), [REST API](), [TypeScript](), [CSS](), [Sass](), [Ajax](), [HTTP]() Tags: [angular](), [api](), [browser](), [cli](), [cors](), [css](), [development](), [frontend](), [http](), [javascript](), [proxy](), [rest-api](), [typescript](), [webpack]() ### AI overview A tutorial explains how to configure the Angular CLI development server to proxy API calls to a separate backend, avoiding the need to use full backend URLs in the application and helping address cross-origin restrictions during local development. ### Source excerpt Lorem ipsum dolor sit amet ## Serverless V1.0 Beta 2 DevFeed: [Serverless V1.0 Beta 2]() Original publisher: [Read original article]() Author: Philipp Müns Published: 2016-08-17T00:00:00Z Content type: release Language: en Sources: [Serverless Blog]() Topics: [serverless framework](), [Cross-origin resource sharing (CORS)](), [Amazon API Gateway](), [Amazon Web Services]() Tags: [2](), [api](), [api-gateway](), [aws](), [aws-api-gateway](), [aws-lambda](), [cloud-computing](), [cors](), [faas](), [function-as-a-service](), [infrastructure-as-code](), [news](), [serverless](), [serverless-architecture](), [serverless-framework](), [v1]() ### AI overview Serverless V1.0 Beta 2 adds CORS support for AWS API Gateway in the serverless framework. ### Source excerpt CORS support added for AWS API Gateway in the serverless framework [Next page]()