Why Your API Passes curl Tests but Fails in the Browser: CORS Explained

Cross-Origin Resource Sharing (CORS) is a browser security mechanism that blocks web pages from making requests to a different origin — such as a different port — than the one that served them. Unlike curl, which sends requests without any concept of origin, browsers enforce this policy to prevent malicious sites from exploiting stored user credentials on third-party services. When an API call involves methods like POST or DELETE, or includes headers such as Authorization, the browser first sends a preflight OPTIONS request to verify the server permits cross-origin access. The server must respond with the appropriate access-control headers; if it does not, the actual request is never made, which explains why server logs may show a 200 status while the browser console reports an error. A lightweight Go middleware using only the standard library can handle CORS correctly by checking allowed origins, setting the required headers, and short-circuiting preflight requests before they reach route handlers.