I was trying to understand CORS. As per my understanding, it is a security mechanism implemented in browsers to avoid any AJAX request to domain other than the one open by the user (specified in the URL).

Now, due to this limitation many CORS was implemented to enable websites to do cross origin request. but as per my understanding implementing CORS defy the security purpose of the "Same Origin Policy" (SOP).

CORS is just to provide extra control over which request server wants to serve. Maybe it can avoid spammers.

From Wikipedia:

To initiate a cross-origin request, a browser sends the request with an Origin HTTP header. The value of this header is the site that served the page. For example, suppose a page on http://www.social-network.example attempts to access a user's data in online-personal-calendar.example. If the user's browser implements CORS, the following request header would be sent:

Origin: http://www.social-network.example

If online-personal-calendar.example allows the request, it sends an Access-Control-Allow-Origin header in its response. The value of the header indicates what origin sites are allowed. For example, a response to the previous request would contain the following:

Access-Control-Allow-Origin: http://www.social-network.example

If the server does not allow the cross-origin request, the browser will deliver an error to social-network.example page instead of the online-personal-calendar.example response.

To allow access to all pages, a server can send the following response header:

Access-Control-Allow-Origin: *

However, this might not be appropriate for situations in which security is a concern.

ajax cors cross-domain
Edit
Report