What is CORS and how does it relate to authentication?

Question

ICSM Computer · Answer

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls whether a
web page from one origin can make requests to a different origin.
What is an "Origin"?
An origin is defined by:
scheme + host + port
Example:
https://api.example.com ≠ https://www.example.com
http://localhost:5000 ≠ http://localhost:5001
Why Does CORS Exist?
To protect users from cross-origin attacks, like a malicious script on
evil.com making unauthorized API calls to bank.com.
Browsers block such requests by default unless the server explicitly allows them using
CORS headers.
What Happens in a CORS Request?
When JavaScript tries to call an API on another origin:
Browser sends a "preflight" request (if needed) using 
OPTIONS.
Server must respond with appropriate CORS headers like:
Access-Control-Allow-Origin: https://myfrontend.com
Access-Control-Allow-Methods: POST, GET
Access-Control-Allow-Headers: Authorization, Content-Type
If not present → browser blocks the request (but the request still hits the server).
How CORS Relates to Authentication
CORS doesn’t provide authentication, but it impacts whether a frontend can call an authenticated API:
1. APIs using cookies (session-based)
To allow cross-origin requests with credentials:
Frontend must call with:
fetch('https://api.example.com/data', {
  credentials: 'include'
});
Backend must allow:
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://yourfrontend.com
Cannot use * for 
Access-Control-Allow-Origin if using credentials.
2. APIs using tokens (e.g., JWT)
Frontend adds Authorization header:
fetch('https://api.example.com/data', {
  headers: {
    'Authorization': 'Bearer andlt;tokenandgt;'
  }
});
Server must allow the Authorization header in:
Access-Control-Allow-Headers: Authorization
No need for cookies or Access-Control-Allow-Credentials.
Summary: CORS vs. Authentication
Feature
CORS
Authentication
Purpose
Protect browser from cross-origin requests
Verify user identity
Enforced by
Browser
Server
Applies to
Frontend → API calls
All calls
Can block requests?
Yes (in browser)
No, but server can reject unauthorized users
Needed for token auth?
Yes, must allow Authorization header
Yes
Needed for cookie auth?
Yes, must allow credentials
Yes
In ASP.NET Framework (Web API):
You can enable CORS using NuGet:
Install-Package Microsoft.AspNet.WebApi.Cors
Then configure:
public static void Register(HttpConfiguration config)
{
    var cors = new EnableCorsAttribute("https://yourfrontend.com", "*", "*");
    cors.SupportsCredentials = true;
    config.EnableCors(cors);
}

interview

What is CORS and how does it relate to authentication?

ICSM Computer

Can you answer this question?

1 Answers

What is an "Origin"?

Why Does CORS Exist?

What Happens in a CORS Request?

How CORS Relates to Authentication

1. APIs using cookies (session-based)

2. APIs using tokens (e.g., JWT)

Summary: CORS vs. Authentication

In ASP.NET Framework (Web API):

Liked By

Feature	CORS	Authentication
Purpose	Protect browser from cross-origin requests	Verify user identity
Enforced by	Browser	Server
Applies to	Frontend → API calls	All calls
Can block requests?	Yes (in browser)	No, but server can reject unauthorized users
Needed for token auth?	Yes, must allow `Authorization` header	Yes
Needed for cookie auth?	Yes, must allow credentials	Yes