CORS (Cross-Origin Resource Sharing) リファレンス
リファレンス 用 CORS protocol: preflight requests, headers, および credential handling.
Preflight and Simple Requests
CORS allows browsers to make cross-origin requests that would otherwise be blocked by same-origin policy. Simple requests (GET/HEAD/POST with safe headers) are sent directly with an Origin header. Preflight requests use OPTIONS to check server policy before the actual request. The server responds with Access-Control-Allow-Origin and method/header allowances. Non-simple requests require preflight to prevent CSRF-like issues.
- simple
- No preflight needed
- preflight
- OPTIONS check
- Origin
- Request header
GET/HEAD/POST safenon-simple requestsidentifies originHeaders and Credentials
Access-Control-Allow-Origin specifies allowed origins (* or specific). Allow-Credentials: true enables cookies and auth headers. Allow-Methods and Allow-Headers list permitted non-simple values. Max-Age caches preflight results. Expose-Headers lets JavaScript read additional response headers. Misconfigured CORS can create security vulnerabilities, especially with credentials and wildcard origins. Never combine Allow-Origin: * with Allow-Credentials: true.
- Allow-Origin
- Permitted origins
- credentials
- Cookies/auth enabled
- security
- Never * + credentials
* or specificAllow-Credentials: trueCSRF risk