Configuring CORS and CSRF
Browsers restrict cross-origin requests from scripts for security reasons. For example, a call from http://mydomain.com to http://mydomain-2.com can't be made using a script. Also, an origin not only indicates a domain—in fact, it includes a scheme and a port too.
Before hitting to any endpoint, the browser sends a preflight request using the HTTP method option to check whether the server would permit the actual request. This request contains the following headers:
- Actual request's headers (
Access-Control-Request-Headers) - A header containing the actual request's HTTP method (
Access-Control-Request-Method) - A
Originheader that contains the requesting origin (scheme, domain, and port) - If the response from the server is successful, then only the browser allows the actual request to fire. The server responds with other headers, such as
Access-Control-Allow-Origin, which contains the allowed origins (an asterisk*value...
