What is CORS?

CORS - Cross Origin Resource Sharing allows us to relax the security applied to an API. By default the Single Origin Policy applies and a website can only make calls to its own origin. In the case though where you have a sub domain or even some third party sites that need access to you API CORS allows us to provide this to just those specific sites without having to open up the API to all origins. In this tutorial video we look at some example APIs on the web today and how they handle CORS.
swapi.co/
api.chucknorri...
CORS will add the the response header [access-control-allow-origins] and specify which origins are to be permitted access. This can include a wildcard, which is how the above 2 sites handle this.
Then create our own sample API and show how to add CORS headers to allow access from other Origins. The example is created in dotnet core within Visual Studio.
It should be noted that CORS and SOP is something applied by web browsers and does not take effect in other applications. So a node console app would be able to access an API even though it is not from the same origin.
P.S Just joined buy me a coffee :-)
www.buymeacoff...

[@jeroincababat565]

I appreciate that you didn't cut the video when you encountered an error. It demonstrates what happens in real-world coding.

[@Ashotofcode]

Cool thanks :-)

[@mib141345]

You explained in 13 mins what I spent hours reading and not comprehending. Thanks!

[@Ashotofcode]

Glad it helped Doran!

[@Hamza_lachgar]

Thanks for this amazing tutorial. it clarifies my knowledge about CORS

[@tedisrozenfelds7630]

I liked that you failed couple of times and then debugged your own code. That actually showed some common mistakes that can be made and should be avoided!

[@Ashotofcode]

Cool thanks Tedis 😀

[@giorgidzidziguri610]

best tutorial out there

[@Ashotofcode]

Thanks!

[@maspoetry1]

i merge to the crowd, great video. thanks. I like when you solve the problems in real time, without editing.

[@Ashotofcode]

No problem!

[@tajsec498]

whole day I was struggling with this :)) your explanation was clearrr, thanksss

[@Ashotofcode]

Glad it helped! :-)

[@user-ii5lr1td8h]

Watched once subscribed twice.

[@mujthabahassan7614]

Thanks a lot, I was scratching my head a lot over this but you explained it briefly yet comprehensively

[@Ashotofcode]

Hi Mujthaba, glad it was helpful 😀

[@suryakiran2207]

More simplified, thanks a lot for great explanation.

[@dhruvpatel6937]

Very clear explanation, thank you kind sir!

[@Ashotofcode]

Welcome :-) Cheers Mark

[@joespinelli3604]

Awesome stuff! Thanks for being so clear and the example was very easy to follow:)

[@micahnewsum3667]

Props to this guy for live coding.

[@Ashotofcode]

Thanks Micah :-)

[@ArijeetSarkar7]

It helped me understand what is CORS and I solved a real world problem. The problem was the origin doesn't support any headers and I was sending one. After I removed, it started working.

[@Ashotofcode]

Excellent, glad it helped Arijeet :-)

[@wesleygomes4154]

man, thanks a lot for sharing this knowledge. You made this topic very clear to me now!

[@nyplace1]

phenomenal explanation!

[@jessandgary5940]

Finally, i get it! Thanks.

[@Ashotofcode]

Glad it helped! Cheers Mark 🙂

[@jig4576]

Awesome video

[@Ashotofcode]

Thanks! Cheers Mark 🙂

[@BB855036]

Great explanation. Thanks!

[@Ashotofcode]

You're welcome!

[@shivarammuthukumaraswamy7164]

wonderfully explained.TYSM

[@Ashotofcode]

Glad it was helpful Shivaram! Cheers Mark :-)

[@ninjarogue]

Thank you!!! I really appreciate the video!

[@Ashotofcode]

Glad it was helpful Aric :-)

[@balapraneeth9708]

Great video. Helped a lot. Thanks mate :)

[@Ashotofcode]

Glad it helped :-)

[@sabithapoladi5620]

very good explanation

[@ttoktassynov]

well explained! thanks

[@Ashotofcode]

Glad you liked it Timur :-)

[@jamesscott-nicholson3808]

Thanks for the video, that's cleared it up for me nicely :). If CORS is something only handled by the browser, I suppose that makes it a fairly weak piece of security. Could a browser / extension be made that simply ignores CORS or injects in the necessary header?

[@Ashotofcode]

Thanks James, I'm not really up on the capabitilites of extensions, but they have full control so would think they would be able cause problems here yes. Cheers Mark

[@abhijithk1397]

yes, you can find extensions in chrome store that disable CORS

[@mineralisk]

Thanks for making the video

[@ashwinisidhu]

shot & easy. Thanks

[@WolfgangPedain]

well done

[@Ashotofcode]

Thanks :-)

[@arfan8544]

Thank You very much. 🤘

[@Ashotofcode]

Thanks SM, glad it was useful 😀

[@YosepRA]

So it's all about the back-end setting up CORS headers, and the browser will try to find these headers to determine whether there's CORS violation or not.

[@Ashotofcode]

Yep that's a good summary I'd say😀

[@louisecrowe4968]

Thanks great video :)

[@Ashotofcode]

Glad you liked it Louise. Cheers Mark :-)

[@thisurathenuka8362]

Nice explanation ❤

[@Ashotofcode]

Glad you liked it Thisura :-)

[@unknownqweasd]

it was very helpfull, thank you!

[@Ashotofcode]

Glad it was helpful! Cheers Mark

[@jagadeeshg3756]

WoW, Thank you so much!

[@MrParanos]

Very clear and useful, yet there is still something my mind can't put hand on : in what are CORS useful ?
Regarding how easy it is to go arount it... :/

[@Ashotofcode]

CORS is actually more about relaxing the existing security, so by default only requests from your own site can be made, which is the same-origin policy. With CORS we can allow other sites to access also. So one good scenario is when our API is on a different domain to our website - in this case CORS will allows us to let the website access our API - as otherwise will be blocked by the same origin policy.
Another case is simply a public API and we want to allows anyone to call it, say a weather api, by default it is restricted to just the domain it runs under, so we add CORS to relax this security and allow anyone to call it.
So CORS itself is not something to get around - that is the same origin policy - which is pretty locked down in browsers.
Cheers
Mark

[@ameyapatil1139]

Excellent ! Thanks !

[@erdemarslan3371]

thx very clear!!

[@Ashotofcode]

Thanks Erdem :-) glad it was useful.

[@anishamalynur7748]

hey quick question one of the options to fix the error was "If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled." could you explain this?

[@Ashotofcode]

Hi Anisha, good question, this would be if you simply wanted to check that the service existed, in that it returns a success code, but without any data. I'm not sure when this would be useful, but there are cases I guess. Cheers Mark

[@dartme18]

ua-cam.com/video/pDU_jnD2XpE/v-deo.html ; different Anisha I assume :-P

[@iQCudi]

amazing

[@Ashotofcode]

Thank you! Cheers!

[@CryptoJitsu]

Great vid, thank you! QUESTION: When the API does not send back the response header [access-control-allow-origins]... I'm assuming it's still sending back the data in the response body... because the decision to show or not is being done by the receiving browser. This seems insecure and dangerous and something a hacker could get around, no?

[@Ashotofcode]

Thanks! Good question - Yes I think you are correct in that the data will be returned - the browsers are pretty solid though so I would think safe - this takes place internally in the browser so not something you can attack with Javascript really. Cheers Mark

[@CryptoJitsu]

@@Ashotofcode thanks!

[@ganeshk8682]

Thanks..

[@Ashotofcode]

Welcome

[@daminduliyanage]

Thank You 👍🏻👍🏻

[@tonyj4435]

Thanks bro

[@Ashotofcode]

Welcome 😎

[@michi19935]

One question - maybe anyone knows: Why can i not log out the json response one the first .then method?

[@Derekbylck]

=> return

[@Ashotofcode]

Ah yes that one gets me a lot! thanks

[@saqlainmushrif6453]

Can cors be exploited if some token is in URL?? (GET METHOD)
Arbitrary origin is reflected in response with ACAO & ACAC but the token is in URL

[@dartme18]

RIP, SWAPI

[@Ashotofcode]

D'oh yep it has died!

[@dartme18]

@@Ashotofcode Someone posted a duplicate pretty quickly after SWAPI died (that was six months ago I think?). Our company used SWAPI for interview exercises, so we were happy to see the replacement!

[@Ashotofcode]

@@dartme18 Ah yes, swapi.dev, cool thanks!

[@smashed5826]

The explanation was not deep enough, in this video you just explianed CORS is browser security policy stuff and seeing you tried it out for direct access on browser and via ajax call. It could be deeper to explain why browser needs this; what kind of attacks could be implemented if no this security policy on browser; What headers needs to be added to allow browser calls a cors resource, different browsers or same browser with different versions treat different headers to allow CORS; server side API header settings to control the access the resource in different scenarios etc.

[@JulienReszka]

audio is very low volume, I wish it wasn't that low

[@ValentinTruta]

Arrow functions return by default if code is on the same line.

[@Ashotofcode]

Nice thanks Valetin!

[@addtyu6176]

I closed the video immediately after seeing Microsoft Edge being used....

[@Ashotofcode]

lol fair play :-)

[@trumbaron]

Confusing for me...

[@aravind4444]

please explain with diagram

[@ramiz3570]

+

[@ronaldlogan3525]

very poorly explained, uses tools people may not be familiar with, the actual subject is almost ignored