Comparison
CORSvsSame-origin policy
CORS
the request worked in curl and failed in the browser with a message about an Access-Control header.
The protocol by which a server tells the browser which other origins may read its responses, using `Access-Control-Allow-*` headers. It is entirely enforced by the browser and entirely configured on the server, which is why no amount of client-side code fixes a CORS error. Wildcarding the allowed origin is fine for public data and forbidden with credentials, which is where most misconfigurations start.
Full entry →Same-origin policy
the script could send the request but was not allowed to read what came back.
The rule that a document may not read data from a different origin unless that origin allows it. Note what it does not prevent: the request is often still sent, and side effects still happen, which is exactly why cross-site request forgery works. It is the default that CORS exists to relax, and the reason an iframe from another origin is an opaque box.
Full entry →