Because our GeoServer is hosted at a different origin than our web application (a different port is enough to make a domain be considered by a browser to be a different origin; an origin is a combination of protocol, host, and port), we will not be able to perform AJAX requests straight away as the browser will refuse to retrieve the data from such a location. This is due to the same-origin policy that is meant to prevent scripts from untrusted sources gaining access to the DOM of a page.
CORS (Cross Origin Resource Sharing) is a standard mechanism for cross origin communication between browsers and servers. The CORS specification defines a set of headers that are used to communicate which operations are allowed. Thanks to that, it is possible to expose APIs that can be consumed by web clients located in different domains than the API itself.
In order to enable our web apps to send AJAX requests...
