Topic
CORS
Trace cross-origin browser requests, preflight exchanges, response headers, credentials, and common CORS failure modes.
- HTTP Headers
Access-Control-Allow-Credentials Header
Learn how Access-Control-Allow-Credentials controls whether browsers expose responses when credentials (cookies, auth headers) are included in CORS requests.
- HTTP Headers
Access-Control-Allow-Headers Header
Learn how Access-Control-Allow-Headers specifies which custom HTTP headers can be used during cross-origin requests in CORS preflight responses.
- HTTP Headers
Access-Control-Allow-Methods Header
Learn how Access-Control-Allow-Methods specifies which HTTP methods are permitted for cross-origin requests in CORS preflight responses.
- HTTP Headers
Access-Control-Allow-Origin Header: CORS Errors and Fixes
Access-Control-Allow-Origin explained: exact browser errors, why * fails with credentials, why you need Vary: Origin, and fixes for nginx, Express and Django.
- HTTP Headers
Access-Control-Expose-Headers: Read Headers in fetch()
Fix response.headers.get() returning null on cross-origin fetch. Access-Control-Expose-Headers, safelisted headers, and why * fails with credentials.
- HTTP Headers
Access-Control-Max-Age Header
Learn how Access-Control-Max-Age specifies how long browsers can cache CORS preflight results. Reduce preflight requests and improve cross-origin performance.
- HTTP Headers
Access-Control-Request-Headers Header
Learn how Access-Control-Request-Headers tells servers which custom headers will be used in CORS requests. Essential for preflight request handling.
- HTTP Headers
Access-Control-Request-Method Header
Learn how Access-Control-Request-Method tells servers which HTTP method will be used in the actual CORS request. Essential for preflight request handling.
- Comparisons
CORS vs CSP
Understand the difference between CORS and Content Security Policy. Both are browser security mechanisms but they protect against completely different threats.
- Comparisons
CORS vs CSRF: Response Reads vs Forged Writes
CORS controls cross-origin response reads; CSRF abuses automatically sent credentials. Compare preflights, SameSite, tokens, Origin and Sec-Fetch-Site.
- Guides
Cross-Origin Resource Sharing (CORS)
Master Cross-Origin Resource Sharing (CORS) for secure cross-origin HTTP requests. Learn preflight requests, headers, credentials, and common error solutions.
- HTTP Headers
Cross-Origin-Embedder-Policy
Learn how Cross-Origin-Embedder-Policy (COEP) controls cross-origin resource loading. Required for SharedArrayBuffer and high-resolution timer access.
- HTTP Headers
Cross-Origin-Opener-Policy
Learn how Cross-Origin-Opener-Policy (COOP) isolates your browsing context from cross-origin documents. Required for SharedArrayBuffer and enhanced security.
- HTTP Headers
Cross-Origin-Resource-Policy
Learn how Cross-Origin-Resource-Policy (CORP) blocks no-cors cross-origin requests to protect resources from Spectre attacks and data leaks.
- Debug Guides
How to Debug a Failed CORS Preflight
Diagnose a failed CORS OPTIONS preflight by checking the requested origin, method, headers, credentials, redirects, and proxy behavior.
- HTTP Methods
HTTP OPTIONS Method
Learn how HTTP OPTIONS requests discover server capabilities, supported methods, and handle CORS preflight checks for cross-origin requests.
- Debug Guides
No 'Access-Control-Allow-Origin' Header Is Present: Fix CORS
Fix the CORS error 'No Access-Control-Allow-Origin header is present on the requested resource' with working Express, nginx, S3, Workers and Django fixes.
- Glossary
Origin (Scheme, Host, Port)
An origin is the scheme, host and port of a URL. See how browsers compare origins for the same-origin policy, CORS and the Origin header, with examples.
- HTTP Headers
Origin Header
Learn how the Origin header identifies where cross-origin requests come from. Essential for CORS security policies and preventing cross-site request forgery.
- Glossary
Preflight Request (CORS OPTIONS)
A CORS preflight is an automatic OPTIONS request the browser sends before a cross-origin request to check permission. See when it fires and how to answer it.
- HTTP Headers
Timing-Allow-Origin
Learn how the Timing-Allow-Origin header specifies which origins can access Resource Timing API data. Enable cross-origin performance monitoring securely.
- Debug Guides
Why Is My Cookie Not Being Sent?
A step-by-step checklist for cookies missing from HTTP requests: Domain, Path, Secure, SameSite, fetch credentials, CORS, expiry and browser blocking.
More topics
- 63 pages
Security
Study HTTP security controls for transport, cookies, browser isolation, authentication, content policy, and response hardening.
- 24 pages
Performance
Improve HTTP delivery with caching, compression, connection reuse, timing signals, and response metadata.
- 22 pages
Caching
Learn how browsers and intermediaries store, validate, and reuse HTTP responses with cache directives, validators, and conditional requests.
- 22 pages
Cookies
Understand cookie storage, scope, transport, expiration, and security across HTTP headers, attributes, and session flows.