CORS
Cross-Origin Resource Sharing (CORS) is a web standard that uses HTTP headers to let servers specify which origins may access their resources through browsers.
ASP.NET Core in Action, 3e
Cross-origin resource sharing is a browser and server mechanism that controls whether a web application may make requests across origins and which parts of those requests and responses are permitted.
- How it is used
- Enables browser JavaScript at one origin to access an API at another origin when the API permits it.
- How deep it goes
- Explains origins, response headers, preflight requests, and ASP.NET Core policy setup while leaving specification details to the framework.
- Examples
- Uses a shopping website calling a separate product API, failed browser requests, and ASP.NET Core policy and endpoint listings.
- What you can do after
- Apply it via ASP.NET Core AddCors(), UseCors(), and RequireCors() to permit selected cross-origin API access.
Building Web APIs with ASP.NET Core
Cross-Origin Resource Sharing (CORS) is a browser security mechanism that controls whether web clients may request resources from a different origin.
- How it is used
- Enables browser scripts at another origin to request API resources under server-defined rules.
- How deep it goes
- Defines the browser restriction and walks through ASP.NET Core policies, middleware, and endpoint assignment without examining browser internals.
- Examples
- Uses default and named policy listings, endpoint configuration, and a GET-only Minimal API exercise.
- What you can do after
- Operate/configure it in ASP.NET Core by registering policies, enabling middleware, and assigning endpoint-specific rules.
Read how Building Web APIs with ASP.NET Core explains CORS →
Spring Security in Action, Second Edition
Cross-origin resource sharing is a browser security mechanism that controls whether a web page may access resources from another origin.
- How it is used
- Explains how browser-based frontends access backend resources hosted on different origins.
- How deep it goes
- Covers browser rejection, HTTP headers, preflight requests, and endpoint or centralized Spring configuration.
- Examples
- Uses example.com, example.org, localhost:8080, an iframe, XMLHttpRequest, and a /test endpoint returning HELLO.
- What you can do after
- Configure endpoint-specific or centralized CORS rules and test browser acceptance of cross-origin responses.
Read how Spring Security in Action, Second Edition explains CORS →
Build Financial Software with Generative AI (From Scratch)
Cross-Origin Resource Sharing (CORS) is a browser security mechanism that controls whether a web page may request resources from a different origin.
- How it is used
- Uses CORS to connect browser-hosted dashboards with APIs while controlling which external origins, methods, and headers are accepted.
- How deep it goes
- Explains simple and preflight requests, required response headers, and FastAPI middleware configuration, but defers deeper browser protocol internals.
- Examples
- Uses localhost dashboards, a health-status endpoint, a browser CORS error, and FastAPI configurations for GET or GET-plus-POST access.
- What you can do after
- Operate/configure it through FastAPI CORSMiddleware with explicit origins, methods, headers, and credential settings.
Read how Build Financial Software with Generative AI (From Scratch) explains CORS →
Spring in Action, Sixth Edition
CORS is a web security mechanism that allows a server to declare which origins may access its resources from browser-based clients.
- How it is used
- Enables a separate JavaScript client to consume a Spring REST API from an approved host or port.
- How deep it goes
- Explains the browser restriction and demonstrates annotation-based origin configuration, but does not detail CORS protocol exchanges.
- Examples
- Demonstrates @CrossOrigin on TacoController with one or multiple allowed origins.
- What you can do after
- Apply CORS via Spring's @CrossOrigin annotation to permit named browser client origins.
Related concepts
- @crossoriginconfigured by · @CrossOrigin is a Spring annotation that enables and configures cross-origin resource sharing for a controller or request handler.
- cross-origin requestconfigures · A cross-origin request is a network request from a webpage or script to a resource whose origin differs from the requester’s origin.
- HTTP headeruses · An HTTP header is a named metadata field in an HTTP request or response that conveys information about the message or directs its processing.
- cross-origin policyaddresses · The same-origin policy is a browser security restriction that limits scripts and documents from accessing resources associated with different origins unless explicitly permitted.
- HTTP GETuses · HTTP GET is a request method for retrieving a representation of a resource identified by the request target, without requesting a state change.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.