Here's what I know about CORS: It allows you to access data on another domain from the frontend of any other website, as long as the access-control-allow-origin property is properly set on the machine that is serving the data.

Desktop software is able to pull data from any website and do what it chooses with this, but web browsers specifically restrict grabbing data from a different domains (unless cors or jsonp is used).

So, not having cors turned on protects the server from serving to the wrong site, or does it protect the frontend browser in some way?

  • 1
    CORS (and the SOP in general) serves to protect copyright holder's content, it's not really a security measure, since as you note, such sites are accessible by non-browsers.
    – dandavis
    Aug 29, 2018 at 16:05

1 Answer 1


CORS is only to prevent cross-origin reading inside the browser.

Before CORS was implemented in the browsers simple requests (i.e. form upload, embedding image etc) could do cross-origin requests (and thus also CSRF attacks) could display the response inside the browser but could not access the response from inside JavaScript. And XMLHTTPRequest and similar were restricted to access same-origin only but could read the response within JavaScript when doing a same-origin request (Same-Origin-Policy).

CORS mainly deals with the latter restriction: if the server explicitly allows cross-origin access then cross-origin XHR will be allowed both to send a request and also to read the response from within JavaScript (like only with same-origin before). And the browser can include existing cookies and similar when doing such cross-site request and thus do cross-site reads within a previously authenticated session.

But what does this mean for applications outside the browser: Since these are not expected to be used as an attack vector for cross-site reading in the first place they are irrelevant in the context of CORS. Of course, if such an application actually implements browser-like behavior and actually supports authenticated cross-site requests then it should also implement the relevant protections browsers have, i.e. Same-Origin-Policy and CORS.

Note that CORS is not a replacement for authentication. A server still has to implement proper authentication to restrict what kind of data the users can retrieve. But with CORS a cross-site requests can be made which uses the existing authentication to retrieve protected content cross-site - but only if allowed by the CORS policy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.