Cross-origin resource sharing

In computing, cross-origin resource sharing (CORS) is a mechanism to safely bypass the same-origin policy; that is, it allows a web page to access restricted resources from a web server on a domain name different from the domain that served the web page. A web page may freely embed cross-origin images, stylesheets, scripts, iframes, and videos. Certain "cross-domain" HTTP requests, notably Ajax requests, are forbidden by default by the same-origin security policy. CORS defines a way in which a web browser and server can interact to determine whether it is safe to allow the cross-origin request. It allows for more freedom and functionality than purely same-origin requests, but is more secure than simply allowing all cross-origin requests. The specification for CORS is included as part of the WHATWG's Fetch Living Standard. This specification describes how CORS is currently implemented in browsers. An earlier specification was published as a W3C Recommendation.