CORS: The Browser Security Model and Why Servers Must Opt In

Developers think CORS errors mean the server is rejecting their request, so they add CORS headers to the client. CORS is a server-side configuration, not something the client can bypass.

CORS exists because the Same-Origin Policy prevents web pages from reading responses from other origins. The server signals the browser that cross-origin reads are allowed.

// Express CORS middleware
app.use((req, res, next) => {
  const allowed = ['https://app.example.com', 'https://admin.example.com'];
  const origin = req.headers.origin;
  if (allowed.includes(origin)) {
    res.setHeader('Access-Control-Allow-Origin', origin);
    res.setHeader('Vary', 'Origin'); // cache correctly per origin
  }
  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
  if (req.method === 'OPTIONS') return res.sendStatus(204);
  next();
});

The browser enforces CORS — the request often does reach the server. The browser then refuses to expose the response to JavaScript if CORS headers are missing. This is why 'it works in Postman but not in the browser'.