Cross-Origin Resource Sharing (CORS)

​

What is CORS?

Cross-Origin Resource Sharing (CORS) is a browser-implemented security measure designed to safeguard the user’s sensitive data. It works by barring web applications from making requests to a domain that differs from the one where the application originated from. These are known as cross-origin requests. This restriction, termed the “same-origin policy,” is intended to prevent malicious scripts on one page from accessing sensitive data on another web page through the latter’s DOM.

​

Why is CORS needed?

There are instances where legitimate web applications may require making cross-origin requests. Your application may need to pull data from a public API, interface with other services hosted on distinct domains, or utilize third-party resources that are hosted elsewhere. These scenarios underscore the importance of CORS.

​

How CORS works?

CORS provides a method for web applications to circumvent the same-origin policy in a controlled manner. This is accomplished by incorporating specific HTTP headers that instruct the browser to allow a web application running at one origin to access selected resources from a server at a different origin.

​

Role of CORS in our solution

In the context of Corbado’s solution, we utilize CORS to securely enable interaction between our service and your web application. We set this up by defining the authorized origins (your application’s domain) in our developer panel. The authorized origins are essentially the list of URLs of your web applications where our login web component can be embedded securely.

By taking this approach, we ensure that cross-origin requests originating from your web applications to our service are legitimately permitted. This approach safeguards against potential security risks while still facilitating necessary cross-domain communication.

​

Securing CORS

Incorrect configuration of CORS can lead to security vulnerabilities. It is, therefore, crucial to limit the authorized origins only to domains that should legitimately be making cross-origin requests to your service. This ensures a secure and functional implementation of CORS in your application.