CORS (https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS) is more like the 'allowed exceptions' to the same-origin policy (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy). A server has to specifically allow access from particular domains/hosts for the request to go through correctly.

Welcome to the Treehouse Community

Want to collaborate on code errors? Have bugs you need feedback on? Looking for an extra set of eyes on your latest project? Get support with fellow developers, designers, and programmers of all backgrounds and skill levels here with the Treehouse Community! While you're at it, check out some resources Treehouse students have shared here.

Looking to learn something new?

Treehouse offers a seven day free trial for new students. Get access to thousands of hours of content and join thousands of Treehouse students and alumni in the community today.

Start your free trial

Watch Video

Posted January 19, 2015 6:10am by

How can CORS allow cross-origin requests if the same-origin policy forbids them?Aren't they contradicting each other?

1 Answer

January 20, 2015 11:03pm

CORS is more like the 'allowed exceptions' to the same-origin policy. A server has to specifically allow access from particular domains/hosts for the request to go through correctly.

Posting to the forum is only allowed for members with active accounts.
Please sign in or sign up to post.