CORS (Cross-Origin Resource Sharing)
This encyclopedia entry introduces the CORS (Cross-Origin Resource Sharing) standard, a key element of modern web security. The description clarifies the most common misunderstanding: the restriction is enforced not by the server, but by the browser to protect the Same-Origin Policy. We discuss the operating mechanism in detail, distinguishing simple requests from complex calls that require preflight. We introduce the HTTP headers required for regulation and discuss the security risks arising from incorrect configuration (for example, using the * wildcard together with authentication). The article provides a practical guide to correctly configure the most popular web servers (Apache, Nginx) and PHP applications. Finally, we provide troubleshooting tips, highlighting why API clients (e.g. Postman) and web browsers behave differently.