CORS-enabled server not denying requests

by

CORS configuration on its own isn’t going to cause a server to deny requests. You can’t cause server-side blocking of requests just through CORS configuration.

The only thing servers do differently when you configure CORS support is just to send the Access-Control-Allow-Origin response header and other CORS response headers. That’s it.

Actual enforcement of cross-origin restrictions is done only by browsers, not by servers.

So no matter what server-side CORS configuration you make to a server, the server still goes on accepting requests from all clients and origins it would otherwise; in other words, all clients from all origins still keep on getting responses from the server just as they would otherwise.

But browsers will only expose responses from cross-origin requests to frontend JavaScript code running at a particular origin if the server the request was sent to opts-in to permitting the request by responding with an Access-Control-Allow-Origin header that allows that origin.

That’s the only thing you can do using CORS config. You can’t make a server only accept and respond to requests from particular origins just by doing any server-side CORS configuration. To do that, you need to use something other than just CORS configuration.

More Related Contents:

  1. Why doesn’t adding CORS headers to an OPTIONS route allow browsers to access my API?
  2. No ‘Access-Control-Allow-Origin’ – Node / Apache Port Issue
  3. How to enable cross-origin resource sharing (CORS) in the express.js framework on node.js
  4. Allow CORS REST request to a Express/Node.js application on Heroku
  5. Error: getaddrinfo ENOTFOUND in nodejs for get call
  6. Access to XMLHttpRequest at ‘…’ from origin ‘localhost:3000’ has been blocked by CORS policy
  7. Getting express server to accept CORS request
  8. static files with express.js
  9. How do I redirect in expressjs while passing some context?
  10. Extend Express Request object using Typescript
  11. res.sendFile absolute path
  12. Avoid “current URL string parser is deprecated” warning by setting useNewUrlParser to true
  13. mongoError: Topology was destroyed
  14. create a trusted self-signed SSL cert for localhost (for use with Express/Node)
  15. IIS, Node.js, and Web Application with IISNode not configured right with Virtual Directory
  16. express logging response body
  17. What is the parameter “next” used for in Express?
  18. First Heroku deploy failed `error code=H10`
  19. npm can’t find package.json
  20. Get hostname of current request in node.js Express
  21. NodeJS / Express: what is “app.use”?
  22. passport.js passport.initialize() middleware not in use
  23. Enable Access-Control-Allow-Origin for multiple domains in Node.js [duplicate]
  24. Catch all uncaughtException for Node js app
  25. ENOENT: no such file or directory .?
  26. Allowing frontend JavaScript POST requests to https://accounts.spotify.com/api/token endpoint
  27. Why can’t we do multiple response.send in Express.js?
  28. Node.js: how to limit the HTTP request size and upload file size?
  29. Displaying an image with EJS in node.js/express
  30. node.js, Error: Cannot find module ‘express’

Leave a Comment