How do CORS and the Same-Origin Policy work together?
The Same-Origin Policy blocks cross-origin access by default. When a server returns CORS headers allowing a specific origin, the browser relaxes the policy for that origin, allowing the response to be read by scripts from that origin.
Verify This Answer
Cross-check this information using these trusted sources:
More FAQs in CORS vs Same-Origin Policy: What's the Difference?
The Same-Origin Policy is the browser's default rule blocking cross-origin access. CORS is a mechanism that relaxes this policy in a controlled way, letting servers explicitly allow certain origins to access their resources.
No. The Same-Origin Policy is the restriction; CORS is the controlled exception to it. Without CORS, the Same-Origin Policy would block all cross-origin requests. CORS lets servers opt in to allowing specific origins.
The browser enforces both. The server does not enforce them; it only returns headers. The browser reads those headers and decides whether to allow the response to be read by your script.
Still have questions?
Browse all our FAQs or reach out to our support team