CORSWhy the browser blocks a request, and what actually fixes it.ComputingA cross-origin request is one to a different scheme, host or port.1The browser checks the originDifferent origin means the response must opt in.2Simple requests go straight outGET or POST with basic headers. The response is checkedafterwards.3Others get a preflightAn OPTIONS request asks whether the real one is allowed.4The server answers with headersAccess-Control-Allow-Origin, -Methods, -Headers.5The browser allows or blocksThe request may have reached the server either way.COMMON CAUSESMissing Access-Control-Allow-OriginCredentials with a wildcard origin — not allowedA custom header not listed in Allow-HeadersA blocked response often still executed on the server. CORS protectsthe reader, not the server.CORSlearnposters.com
CORS — printable computing wall chart from LearnPosters. Free vector PDF, US Letter and A4.

CORS, step by step

A cross-origin request is one to a different scheme, host or port.

  1. The browser checks the originDifferent origin means the response must opt in.
  2. Simple requests go straight outGET or POST with basic headers. The response is checked afterwards.
  3. Others get a preflightAn OPTIONS request asks whether the real one is allowed.
  4. The server answers with headersAccess-Control-Allow-Origin, -Methods, -Headers.
  5. The browser allows or blocksThe request may have reached the server either way.

Common causes

  • Missing Access-Control-Allow-Origin
  • Credentials with a wildcard origin — not allowed
  • A custom header not listed in Allow-Headers

A blocked response often still executed on the server. CORS protects the reader, not the server.

Questions about the CORS poster

What’s on the CORS poster?
5 numbered steps, with a full worked run-through. A cross-origin request is one to a different scheme, host or port. The browser checks the origin — Different origin means the response must opt in.; Simple requests go straight out — GET or POST with basic headers. The response is che…; Others get a preflight — An OPTIONS request asks whether the real one is allowed.; The server answers with headers — Access-Control-Allow-Origin, -Methods, -Headers.; The browser allows or blocks — The request may have reached the server either way.. A blocked response often still executed on the server. CORS protects the reader, not the server.
Who is the CORS poster for?
CORS belongs to the Computing section rather than to a school year, because computing is not something one grade owns. Anyone learning the web can pin it up — a beginner, a student mid-course, or someone revising years later.
When should you use the CORS poster?
CORS is enforced by the browser and configured on the server. Nothing in your front-end code can fix it. A wall chart earns its place by being glanceable from where the work is happening, so CORS belongs on the wall where that computing work actually happens, within glancing distance, rather than filed away.
What other posters go with CORS?
Accessibility, ARIA and How a Browser Renders sit alongside CORS in the Computing section. Printed together they make a wall rather than a single sheet, which is how a reference set actually gets used.AccessibilityARIAHow a Browser Renders
Is the CORS poster free to download and print?
Yes. CORS downloads as a free PDF with no account, no email and no watermark, like everything else in the Computing section. Print as many copies as you like for a home, a classroom, a library or a tutoring group; reselling the file is the only thing the licence rules out.Read the licence
What size does the CORS poster print at?
CORS is a vector PDF laid out for US Letter, and prints on A4 with Fit to page — the same file, no separate download. Because every mark on it is drawn rather than photographed, it stays sharp enlarged to A3, A2 or A1 at a copy shop. Colour carries emphasis only, so a greyscale print of CORS loses nothing.Printing guide

Related posters

Charts that sit alongside CORS on the same wall.

Browse every Computing poster, or start from the full catalogue.