Configuring CORS and CSRF
Browsers restrict cross-origin requests from scripts for security reasons. For example, a call from http://mydomain.com to http://mydomain-2.com can’t be made using a script. Also, an origin not only indicates a domain but also includes a scheme and a port.
Before hitting any endpoint, the browser sends a pre-flight request using the HTTP method option to check whether the server will permit the actual request. This request contains the following headers:
- The actual request’s headers (
Access-Control-Request-Headers). - A header containing the actual request’s HTTP method (
Access-Control- Request-Method). - An
Originheader that contains the requesting origin (scheme, domain, and port). - If the response from the server is successful, then only the browser allows the actual request to fire. The server responds with other headers, such as
Access- Control-Allow-Origin, which contains the allowed origins (an asterisk*value...
