CORS, Explained (and Why It Keeps Blocking You)

What CORS actually is - the browser protecting users by refusing to let one site read another's responses - how to read the error and the headers, and how to fix it on the server without opening a security hole.

1. Why the Browser Blocks You The same-origin policy means a web page can't read responses from a different origin by default - to protect the logged-in user. CORS is the server's way to say which other origins are allowed.
2. Reading the Error & the Headers Decode the classic 'blocked by CORS policy' console error, the request's Origin header, the response's Access-Control-Allow-Origin header, and the preflight OPTIONS request that fires before non-simple requests.
3. Fixing It Properly Set the right Access-Control-Allow-* headers on the server (not the client), why credentials and wildcard origins can't be combined, why you shouldn't slap Allow-Origin: * on a credentialed or private API, plus a symptom-to-fix cheat-card and a dev-proxy workaround.