What Is CORS and Why Does Your Browser Block Cross-Origin API Requests?

CORS, or Cross-Origin Resource Sharing, is a browser security mechanism that restricts web pages from making requests to a different origin — defined by protocol, domain, and port. Browsers enforce this by default to prevent malicious sites from silently accessing sensitive APIs using a user's credentials. Servers must explicitly permit cross-origin requests by returning headers such as Access-Control-Allow-Origin in their responses. In frameworks like ASP.NET Core, developers can configure named CORS policies to whitelist specific frontend origins rather than allowing all origins. A common debugging tip is to check whether a preflight OPTIONS request is failing before the actual request, and to note that tools like Postman bypass browser CORS enforcement entirely.