A browser retrieves a page, runs its JavaScript, sends web requests, and decides whether to expose responses to the page. For cross-origin calls, it checks server-provided CORS headers; a request may reach the server while its response remains inaccessible to the page. section 10.1
A browser’s CORS behavior becomes visible when an application uses different origin strings:
- Treats localhost:8080 and 127.0.0.1:8080 as different domains, even when they refer to the same host. section 10.1


