Backend interview prep

Start

CORS (Cross-Origin Resource Sharing) Interview Questions and Answers (15 Must-Know Questions)

Master CORS with 15 interview questions and answers. Learn Same-Origin Policy, CORS headers, preflight requests, browser behavior, Spring Boot configuration, API Gateway integration, common CORS errors, best practices, and enterprise use cases.

Introduction

Cross-Origin Resource Sharing (CORS) is a browser security mechanism that allows controlled access to resources hosted on a different origin (domain, protocol, or port). It extends the Same-Origin Policy (SOP) by allowing servers to specify which origins are permitted to access their resources.

Modern frontend frameworks such as React, Angular, Vue.js, Next.js, and mobile web applications frequently communicate with backend REST APIs hosted on different domains. CORS enables these interactions securely.

Understanding CORS is essential for Java, Spring Boot, Microservices, Cloud, Full Stack, and API Security interviews.

What You'll Learn

  • Same-Origin Policy (SOP)
  • What is CORS?
  • Cross-Origin Requests
  • Preflight Requests
  • CORS Headers
  • Browser Behavior
  • Spring Boot Configuration
  • Spring Security Configuration
  • API Gateway CORS
  • Enterprise Best Practices

CORS Architecture

+----------------------+
|  React Application   |
| https://app.com      |
+----------+-----------+
           |
           | HTTP Request
           |
           ▼
+----------------------+
| Spring Boot API      |
| https://api.com      |
+----------------------+

Different Origin
↓

Browser checks CORS policy
↓

Allowed or Blocked

Same-Origin Policy

Two URLs have the same origin only if all three match:

Component Example
Protocol https
Domain example.com
Port 443

Different protocol, domain, or port results in a cross-origin request.

1. What is CORS?

Answer

CORS (Cross-Origin Resource Sharing) is a browser security feature that allows a server to specify which external origins can access its resources.

Without CORS, browsers block most cross-origin requests.

Example:

Frontend:
https://app.company.com

Backend:
https://api.company.com

The backend must explicitly allow the frontend origin.

2. What is the Same-Origin Policy (SOP)?

Answer

Same-Origin Policy is a browser security mechanism that prevents one origin from accessing resources from another origin without permission.

An origin consists of:

  • Protocol
  • Domain
  • Port

Example:

URL Same Origin?
https://app.com ✅
http://app.com ❌
https://api.app.com ❌
https://app.com:8080 ❌

3. Why is CORS Required?

Answer

Modern applications often separate frontend and backend services.

Example:

React App

↓

https://ui.company.com

↓

Spring Boot API

↓

https://api.company.com

Without CORS, browsers block these requests even if the backend is functioning correctly.

4. How Does CORS Work?

Answer

Browser

↓

Cross-Origin Request

↓

Server Response

↓

CORS Headers Present?

↓

Yes → Allow

No → Block

The browser enforces the CORS policy based on the response headers.

5. What is a Preflight Request?

Answer

A preflight request is an HTTP OPTIONS request sent by the browser before certain cross-origin requests.

Purpose:

  • Check allowed methods
  • Check allowed headers
  • Verify server permissions

Flow:

Browser

↓

OPTIONS Request

↓

Server

↓

200 OK

↓

Actual Request

6. Which Requests Trigger a Preflight?

Answer

Preflight is required for requests that use:

  • PUT
  • PATCH
  • DELETE
  • Custom Headers
  • Authorization Header
  • Non-standard Content-Type

Simple GET and POST requests usually do not require a preflight if they meet the browser's "simple request" criteria.

7. What are the Important CORS Headers?

Answer

Header Purpose
Access-Control-Allow-Origin Allowed origins
Access-Control-Allow-Methods Allowed HTTP methods
Access-Control-Allow-Headers Allowed request headers
Access-Control-Allow-Credentials Allow cookies/authentication
Access-Control-Max-Age Cache preflight response

Example:

Access-Control-Allow-Origin: https://app.company.com
Access-Control-Allow-Methods: GET,POST,PUT
Access-Control-Allow-Headers: Authorization,Content-Type

8. What is Access-Control-Allow-Origin?

Answer

This header specifies which origin is allowed to access the resource.

Examples:

Access-Control-Allow-Origin:
https://app.company.com

Avoid using:

*

for authenticated APIs because it is overly permissive and cannot be combined with credentialed requests.

9. What is Access-Control-Allow-Credentials?

Answer

This header allows cookies, sessions, or authentication credentials to be included in cross-origin requests.

Example:

Access-Control-Allow-Credentials: true

When enabled:

  • Wildcard (*) origins cannot be used.
  • A specific trusted origin must be configured.

10. How is CORS Configured in Spring Boot?

Answer

Example:

@Configuration
public class CorsConfiguration {

    @Bean
    public WebMvcConfigurer corsConfigurer() {

        return new WebMvcConfigurer() {

            @Override
            public void addCorsMappings(
                    CorsRegistry registry) {

                registry.addMapping("/**")
                        .allowedOrigins(
                          "https://app.company.com")
                        .allowedMethods(
                          "GET","POST","PUT","DELETE");
            }
        };
    }
}

11. How is CORS Configured in Spring Security?

Answer

@Bean
SecurityFilterChain security(HttpSecurity http)
throws Exception {

    http
        .cors(Customizer.withDefaults())
        .csrf(csrf -> csrf.disable());

    return http.build();
}

Spring Security should allow CORS processing before authentication filters.

12. How Do API Gateways Handle CORS?

Answer

API Gateways can centrally manage CORS policies for multiple backend services.

Responsibilities:

  • Handle OPTIONS requests
  • Return CORS headers
  • Validate allowed origins
  • Reduce duplicate backend configuration

Popular gateways:

  • Kong
  • Apigee
  • Gloo Gateway
  • NGINX
  • AWS API Gateway
  • Azure API Management

13. What are Common CORS Mistakes?

Answer

Common mistakes include:

  • Using * for production APIs
  • Missing OPTIONS handling
  • Blocking Authorization headers
  • Incorrect allowed origins
  • Forgetting credentials configuration
  • Misconfigured API Gateway
  • Missing allowed methods
  • Allowing unnecessary origins
  • Mixing HTTP and HTTPS
  • Ignoring browser developer tools

14. What are CORS Best Practices?

Answer

Recommended practices:

  • Allow only trusted origins
  • Avoid wildcard origins in production
  • Support preflight requests
  • Configure CORS at the API Gateway when possible
  • Allow only required HTTP methods
  • Allow only necessary headers
  • Enable credentials only when required
  • Test browser behavior
  • Log failed preflight requests
  • Review CORS settings regularly

15. How Does CORS Work in Enterprise Architecture?

Answer

                React / Angular
                       │
                       ▼
                 Browser (CORS)
                       │
             OPTIONS Preflight
                       │
                       ▼
                 API Gateway
                       │
              CORS Validation
                       │
          +------------+------------+
          |                         |
          ▼                         ▼
   Spring Boot API           User Service
          │                         │
          └------------+------------┘
                       ▼
                   Database

Enterprise Components

  • Browser
  • API Gateway
  • Spring Security
  • Spring Boot APIs
  • Identity Provider
  • Logging & Monitoring

CORS Summary

Concept Description
CORS Cross-Origin Resource Sharing
SOP Same-Origin Policy
Origin Protocol + Domain + Port
Preflight OPTIONS request
Allow-Origin Permitted origins
Allow-Headers Allowed request headers
Allow-Methods Allowed HTTP methods
Credentials Cookies/authentication
Spring Boot Backend CORS configuration
API Gateway Centralized CORS management

Interview Tips

  1. Explain that CORS is enforced by browsers, not by backend servers.
  2. Clearly define an origin as protocol + domain + port.
  3. Explain the Same-Origin Policy before introducing CORS.
  4. Describe when browsers send preflight (OPTIONS) requests.
  5. Mention the key CORS response headers.
  6. Explain why Access-Control-Allow-Origin: * should be avoided for authenticated APIs.
  7. Discuss Spring Boot and Spring Security CORS configuration.
  8. Explain how API Gateways centralize CORS policies.
  9. Mention browser developer tools for troubleshooting CORS errors.
  10. Use real-world examples with React, Angular, and Spring Boot APIs.

Key Takeaways

  • CORS allows controlled cross-origin communication between browsers and servers.
  • It extends the Same-Origin Policy while maintaining browser security.
  • Browsers enforce CORS based on response headers returned by the server.
  • Preflight (OPTIONS) requests verify permissions before sending certain cross-origin requests.
  • Key headers include Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Allow-Credentials.
  • Spring Boot and Spring Security provide built-in support for CORS configuration.
  • API Gateways can centralize and simplify CORS management across multiple services.
  • Production systems should avoid wildcard origins for authenticated APIs and allow only trusted domains.
  • Understanding CORS is essential for frontend, backend, microservices, cloud, and API security development.
  • CORS is one of the most frequently discussed topics in Java, Spring Boot, Full Stack, and Solution Architect interviews.