CORS vs Same-Origin Policy: What's the Difference?

CORS vs Same-Origin Policy: What's the Difference?

CORS and the Same-Origin Policy are related and often confused. Here is the difference and how they work together.

The Same-Origin Policy

The Same-Origin Policy is the browser's default rule: a script from one origin cannot access resources from a different origin. It is the baseline security rule that has existed since the early web.

What CORS Is

CORS is a mechanism that relaxes the Same-Origin Policy in a controlled way. It lets a server explicitly allow certain other origins to access its resources, by returning specific headers.

The Relationship

The Same-Origin Policy is the rule. CORS is the controlled exception to that rule. Without CORS, the Same-Origin Policy would block all cross-origin requests; CORS lets servers opt in to allowing specific ones.

Who Enforces Each

Both are enforced by the browser. The server does not enforce the Same-Origin Policy; it just returns headers. The browser reads those headers and decides whether to allow the response.

Why the Distinction Matters

Beginners often think CORS is the problem. It is not. The Same-Origin Policy is the restriction; CORS is the relaxation. Understanding this helps you realize the fix is always on the server side.

The Takeaway

The Same-Origin Policy is the default restriction; CORS is the controlled way servers opt in to cross-origin access. Both are enforced by the browser, and the fix for CORS issues is always on the server side.