CORS

Part of the Web course

Your frontend runs on localhost:3000, your API runs on localhost:8000, and the request that works perfectly in curl fails in the browser with a red console message about Access-Control-Allow-Origin. Nothing is broken. The browser is doing exactly what it was designed to do, and it is protecting your users from a genuine attack, and the fix is one response header on the server.

Browsers enforce a boundary called the same-origin policy: JavaScript loaded from one origin may not read responses from a different origin unless that origin explicitly permits it. ...