CORS Interview Questions Every Frontend Developer Should Know
CORS comes up in almost every frontend interview. Here are the questions and how to answer them with real understanding.
CORS Interview Questions Every Frontend Developer Should Know
CORS is a guaranteed topic in frontend interviews because it reveals whether you understand the browser's security model. Here are the common questions.
What is CORS?
CORS stands for Cross-Origin Resource Sharing. It is a browser mechanism that lets a server explicitly allow cross-origin requests, relaxing the Same-Origin Policy in a controlled way.
Why does CORS exist?
To prevent malicious websites from making requests to other sites on behalf of the user. Without it, any site could make requests to your bank using your cookies.
Why does the request work in Postman but fail in the browser?
Because Postman is not a browser and does not enforce CORS. The browser blocks the response if the server did not allow your origin. The request reaches the server; the browser just refuses to hand you the response.
How do you fix a CORS error?
On the server side: set the Access-Control-Allow-Origin header to allow your origin, or route through your own backend proxy. In development, a bundler proxy works. Never disable CORS for users.
What is a preflight request?
For non-simple requests, the browser sends an OPTIONS request first to check what the server allows. The server must respond with the right headers, or the actual request never fires.
How to Answer Well
Explain that CORS is about the browser protecting the user, that the server allows origins through headers, and that the fix is always server-side. Show you understand the security purpose, not just the workaround.
The Takeaway
Know what CORS is, why it exists, why Postman works but the browser blocks, how to fix it, and what a preflight is. Frame CORS as browser security, and the fix as server-side, to answer well.
CORS stands for Cross-Origin Resource Sharing. It is a browser mechanism that lets a server explicitly allow cross-origin requests, relaxing the Same-Origin Policy in a controlled way through response headers.
To prevent malicious websites from making requests to other sites on behalf of the user. Without it, any site could make requests to your bank or email using the user's cookies, which would be a serious security risk.
Because Postman is not a browser and does not enforce CORS. The browser blocks the response if the server did not allow your origin. The request reaches the server; the browser just refuses to hand you the response.
On the server side: set the Access-Control-Allow-Origin header to allow your origin, or route through your own backend proxy. In development, a bundler proxy works. Never disable CORS for users.
For non-simple requests, the browser sends an OPTIONS request first to check what the server allows. The server must respond with the right headers, or the actual request never fires. CORS middleware handles this automatically.
Ready to master React completely?
Want to upskill yourself, crack your next interview, and get your dream job? Join our comprehensive course to dive deeper with high-quality video tutorials, solve interview questions, and a premium community.
Master React
Want to upskill yourself, crack your next interview, and get your dream job? Join our comprehensive course.