Back to Glossary

CORS

CORS

مشاركة الموارد عبر الأصول

GLS-000108

Intermediateauth-security1 min read
cross origin resource sharingcors policycors headeraccess-control-allow-origincross origin
Official DocsSign in to save & take notes

Definition

A browser security feature that controls which domains can make requests to your API.

ميزة أمان في المتصفح تتحكم في أي النطاقات يمكنها تقديم طلبات إلى API الخاص بك.

Why It Matters

If 404Fault's API returns incorrect CORS headers, external sites could call the API in a user's browser and steal their data.

إذا أعادت API في 404Fault رؤوس CORS غير صحيحة، يمكن للمواقع الخارجية استدعاء API في متصفح المستخدم وسرقة بياناته.

Full Definition

CORS (Cross-Origin Resource Sharing) is a browser policy that blocks requests from one domain to another unless the server explicitly allows it. By default, a request from app.xyz.com to api.abc.com is blocked. Servers set CORS headers (Access-Control-Allow-Origin) to whitelist trusted origins. CORS only applies to browser requests — server-to-server calls are not restricted by CORS.
CORS (مشاركة الموارد عبر الأصول) هي سياسة متصفح تحجب الطلبات من نطاق إلى آخر ما لم يسمح بها الخادم صراحةً. بشكل افتراضي، طلب من app.xyz.com إلى api.abc.com محجوب. تضع الخوادم رؤوس CORS (Access-Control-Allow-Origin) لإدراج الأصول الموثوقة في القائمة البيضاء. CORS ينطبق فقط على طلبات المتصفح — الاستدعاءات من خادم إلى خادم غير مقيّدة بـ CORS.

Example Usage

“404Fault's API routes don't need custom CORS headers because they're called from the same domain (404fault.com → 404fault.com/api).”

“مسارات API في 404Fault لا تحتاج رؤوس CORS مخصصة لأنها تُستدعى من نفس النطاق (404fault.com → 404fault.com/api).”

Knowledge Graph

AI Builder Tips

Sign in for more features

Avoid these mistakes when using CORS:

1

Setting Access-Control-Allow-Origin: * on private APIs (allows any site to call it)

2

Confusing CORS with authentication — CORS controls who can call, not who is authorized

Sign in to unlock guided AI explanations from AI Teacher.

Generate a Prompt

Copy this prompt and use it directly with any AI model — no setup needed.

Ready-to-Use Prompt
Help me build a project using CORS.

Explain:
1. What is CORS and why it matters
2. The core architecture and required tools
3. Step-by-step implementation plan
4. Common mistakes to avoid: Setting Access-Control-Allow-Origin: * on private APIs (allows any site to call it), Confusing CORS with authentication — CORS controls who can call, not who is authorized
5. Best practices and production tips

Official Resources

Official Documentation
Browse all AI termsCreate free account