CORS is one of the most frequently asked security topics in Java, Spring Boot, Full Stack, and Microservices interviews. It is a browser security mechanism that controls how web applications access resources hosted on different origins.

---

Q1. What is CORS?

Answer

CORS (Cross-Origin Resource Sharing) is a browser security feature that allows or restricts web applications from making requests to a different origin.

An Origin consists of:

• Protocol (HTTP/HTTPS)
• Domain
• Port

If any one of these changes, it is considered a different origin.

Example

Frontend

https://app.codewithvenu.com

Backend

https://api.codewithvenu.com

Since the domains are different, the browser enforces CORS rules.

---

Q2. Why do we need CORS?

Answer

Browsers implement the Same-Origin Policy (SOP) to prevent malicious websites from accessing resources belonging to another website.

CORS provides a controlled way to allow cross-origin requests.

Example

Frontend

https://myapp.com

Calling

https://api.company.com/users

Without CORS, the browser blocks the request.

---

Q3. What is the Same-Origin Policy?

Answer

Same-Origin Policy (SOP) is a browser security mechanism that prevents JavaScript running on one origin from accessing resources on another origin.

Two URLs are considered the same origin only if all three match:

• Protocol
• Domain
• Port

Example

URL	Same Origin?
https://abc.com	✅
http://abc.com	❌
https://xyz.com	❌
https://abc.com:8080	❌

---

Q4. How does CORS work?

Answer

When a browser sends a cross-origin request, it checks the response headers returned by the server.

Example response:

Access-Control-Allow-Origin: https://app.codewithvenu.com

If the requesting origin matches the allowed origin, the browser allows the response.

Otherwise, it blocks access.

Request Flow

Browser
    │
Cross-Origin Request
    │
Server
    │
Access-Control-Allow-Origin
    │
Browser validates header
    │
Allow or Block

---

Q5. What are the important CORS headers?

Answer

Common CORS headers include:

Access-Control-Allow-Origin

Specifies which origins are allowed.

Access-Control-Allow-Origin: https://app.codewithvenu.com

Access-Control-Allow-Methods

Allowed HTTP methods.

GET, POST, PUT, DELETE

Access-Control-Allow-Headers

Allowed request headers.

Authorization
Content-Type

Access-Control-Allow-Credentials

Allows cookies or credentials.

true

---

Q6. What is a Preflight Request?

Answer

Before sending certain cross-origin requests, the browser first sends an HTTP OPTIONS request.

This is called a Preflight Request.

It verifies whether the server allows the actual request.

Example:

OPTIONS /api/users

The server responds with supported methods and headers.

Only after successful validation does the browser send the actual request.

---

Q7. How do you configure CORS in Spring Boot?

Answer

Spring Boot provides multiple ways to configure CORS.

Controller Level

@CrossOrigin(origins = "https://app.codewithvenu.com")
@RestController
public class UserController {

}

Global Configuration

Configure CORS once for the entire application using a WebMvcConfigurer.

Best Practice

Use global configuration for enterprise applications instead of repeating annotations on every controller.

---

Q8. What are common CORS mistakes?

Answer

Common mistakes include:

• Using

Access-Control-Allow-Origin: *

for secured APIs.

• Allowing every HTTP method.
• Allowing every request header.
• Enabling credentials with wildcard origins.
• Forgetting to handle OPTIONS requests.
• Disabling CORS checks during development and deploying the same configuration to production.

---

Q9. Does CORS provide API security?

Answer

No.

This is one of the most common interview questions.

CORS is not an authentication or authorization mechanism.

It only controls whether a browser allows JavaScript to access responses from another origin.

API security should still use:

• JWT Authentication
• OAuth2
• HTTPS
• Authorization
• Rate Limiting
• Input Validation

Interview Tip

CORS protects browsers, not APIs.

Attackers using Postman, curl, or server-side code are not restricted by CORS.

---

Q10. What are the CORS best practices?

Answer

Follow these best practices:

• Allow only trusted origins.
• Avoid using wildcard (*) in production.
• Restrict HTTP methods.
• Restrict request headers.
• Handle OPTIONS requests correctly.
• Enable HTTPS.
• Use JWT or OAuth2 authentication.
• Configure CORS at the API Gateway when possible.
• Log blocked requests.
• Regularly review allowed origins.

Production Architecture

               Browser
                   │
         Cross-Origin Request
                   │
            API Gateway
                   │
          CORS Validation
                   │
       JWT Authentication
                   │
      Spring Boot Application
                   │
              Database

Senior Interview Tip

CORS should be considered a browser security policy, not an API security mechanism.

Enterprise applications typically combine:

• CORS
• HTTPS
• JWT
• OAuth2
• API Gateway
• Rate Limiting
• WAF
• Authorization

Using multiple security layers provides a stronger defense than relying on CORS alone.

---

Quick Revision

• CORS stands for Cross-Origin Resource Sharing.
• It is enforced by browsers.
• Same-Origin Policy blocks unauthorized cross-origin requests.
• CORS uses HTTP response headers.
• OPTIONS is the preflight request.
• CORS does not replace authentication.
• Never use Access-Control-Allow-Origin: * for secured APIs.
• Configure CORS globally in Spring Boot.
• Restrict origins, methods, and headers.
• Combine CORS with JWT, OAuth2, and HTTPS for production-grade security.