FrontendHaltBrowser internals·Intermediate·Conceptual·1 min read
Does CORS protect a server from receiving malicious cross-origin requests?
Short interview answer
No. CORS is enforced by the browser on the response side to protect users' data from being read by untrusted scripts. A server must independently authenticate and authorize every request regardless of CORS headers.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.