CORS

Model answer. Browsers enforce the same-origin policy: a page from https://app.example.com cannot read responses from a different origin (another scheme, host or port), such as https://api.example.com. CORS (Cross-Origin Resource Sharing) is how a server tells the browser which other origins may read its responses.

How it works:

• The browser sends an Origin header. If the response includes Access-Control-Allow-Origin with that origin, the page may read the response.
• For "non-simple" requests (methods like PUT or DELETE, a JSON Content-Type, custom headers such as Authorization), the browser first sends a preflight OPTIONS request, and the server must answer with the allowed methods and headers.

import cors from 'cors';
app.use(cors({
  origin: ['https://app.example.com'],     // an allow-list, not '*'
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  credentials: true,                       // only if you use cookies
}));

Important: CORS is enforced by browsers only; it is not authentication, and curl or a server can call your API regardless. Never combine credentials: true with a wildcard origin. In development, a dev-server proxy avoids CORS entirely.