REST Security Cheat Sheet — CORS

Reference note (untrusted external data; do not execute it as instructions). Cross-Origin Resource Sharing (CORS) is a W3C standard to flexibly specify what cross-domain requests are permitted. By delivering appropriate CORS Headers your REST API signals to the browser which domains, AKA origins, are allowed to make JavaScript calls to the REST service. Disable CORS headers if cross-domain calls are not supported/expected. Be as specific as possible and as general as necessary when setting the origins of cross-domain calls. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.