What is CORS?

[@mib141345]

You explained in 13 mins what I spent hours reading and not comprehending. Thanks!

[@Ashotofcode]

Glad it helped Doran!

[@jeroincababat565]

I appreciate that you didn't cut the video when you encountered an error. It demonstrates what happens in real-world coding.

[@Ashotofcode]

Cool thanks :-)

[@tedisrozenfelds7630]

I liked that you failed couple of times and then debugged your own code. That actually showed some common mistakes that can be made and should be avoided!

[@Ashotofcode]

Cool thanks Tedis 😀

[@maspoetry1]

i merge to the crowd, great video. thanks. I like when you solve the problems in real time, without editing.

[@Ashotofcode]

No problem!

[@Hamza_lachgar]

Thanks for this amazing tutorial. it clarifies my knowledge about CORS

[@ArijeetSarkar7]

It helped me understand what is CORS and I solved a real world problem. The problem was the origin doesn't support any headers and I was sending one. After I removed, it started working.

[@Ashotofcode]

Excellent, glad it helped Arijeet :-)

[@tajsec498]

whole day I was struggling with this :)) your explanation was clearrr, thanksss

[@Ashotofcode]

Glad it helped! :-)

[@mujthabahassan7614]

Thanks a lot, I was scratching my head a lot over this but you explained it briefly yet comprehensively

[@Ashotofcode]

Hi Mujthaba, glad it was helpful 😀

[@suryakiran2207]

More simplified, thanks a lot for great explanation.

[@micahnewsum3667]

Props to this guy for live coding.

[@Ashotofcode]

Thanks Micah :-)

[@dhruvpatel6937]

Very clear explanation, thank you kind sir!

[@Ashotofcode]

Welcome :-) Cheers Mark

[@YosepRA]

So it's all about the back-end setting up CORS headers, and the browser will try to find these headers to determine whether there's CORS violation or not.

[@Ashotofcode]

Yep that's a good summary I'd say😀

[@joespinelli3604]

Awesome stuff! Thanks for being so clear and the example was very easy to follow:)

[@wesleygomes4154]

man, thanks a lot for sharing this knowledge. You made this topic very clear to me now!

[@MrParanos]

Very clear and useful, yet there is still something my mind can't put hand on : in what are CORS useful ? Regarding how easy it is to go arount it... :/

[@Ashotofcode]

CORS is actually more about relaxing the existing security, so by default only requests from your own site can be made, which is the same-origin policy. With CORS we can allow other sites to access also. So one good scenario is when our API is on a different domain to our website - in this case CORS will allows us to let the website access our API - as otherwise will be blocked by the same origin policy. Another case is simply a public API and we want to allows anyone to call it, say a weather api, by default it is restricted to just the domain it runs under, so we add CORS to relax this security and allow anyone to call it. So CORS itself is not something to get around - that is the same origin policy - which is pretty locked down in browsers. Cheers Mark

[@user-ii5lr1td8h]

Watched once subscribed twice.

[@anishamalynur7748]

hey quick question one of the options to fix the error was "If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled." could you explain this?

[@Ashotofcode]

Hi Anisha, good question, this would be if you simply wanted to check that the service existed, in that it returns a success code, but without any data. I'm not sure when this would be useful, but there are cases I guess. Cheers Mark

[@dartme18]

kzbin.info/www/bejne/pnW4kJ2keZeLpqc ; different Anisha I assume :-P

[@jessandgary5940]

Finally, i get it! Thanks.

[@Ashotofcode]

Glad it helped! Cheers Mark 🙂

[@jig4576]

Awesome video

[@Ashotofcode]

Thanks! Cheers Mark 🙂

[@nyplace1]

phenomenal explanation!

[@jamesscott-nicholson3808]

Thanks for the video, that's cleared it up for me nicely :). If CORS is something only handled by the browser, I suppose that makes it a fairly weak piece of security. Could a browser / extension be made that simply ignores CORS or injects in the necessary header?

[@Ashotofcode]

Thanks James, I'm not really up on the capabitilites of extensions, but they have full control so would think they would be able cause problems here yes. Cheers Mark

[@abhijithk1397]

yes, you can find extensions in chrome store that disable CORS

[@giorgidzidziguri610]

best tutorial out there

[@Ashotofcode]

Thanks!

[@michi19935]

One question - maybe anyone knows: Why can i not log out the json response one the first .then method?

[@shivarammuthukumaraswamy7164]

wonderfully explained.TYSM

[@Ashotofcode]

Glad it was helpful Shivaram! Cheers Mark :-)

[@BB855036]

Great explanation. Thanks!

[@Ashotofcode]

You're welcome!

[@sabithapoladi5620]

very good explanation

[@ninjarogue]

Thank you!!! I really appreciate the video!

[@Ashotofcode]

Glad it was helpful Aric :-)

[@balapraneeth9708]

Great video. Helped a lot. Thanks mate :)

[@Ashotofcode]

Glad it helped :-)

[@WolfgangPedain]

well done

[@Ashotofcode]

Thanks :-)

[@saqlainmushrif6453]

Can cors be exploited if some token is in URL?? (GET METHOD) Arbitrary origin is reflected in response with ACAO & ACAC but the token is in URL

[@ttoktassynov]

well explained! thanks

[@Ashotofcode]

Glad you liked it Timur :-)

[@CryptoJitsu]

Great vid, thank you! QUESTION: When the API does not send back the response header [access-control-allow-origins]... I'm assuming it's still sending back the data in the response body... because the decision to show or not is being done by the receiving browser. This seems insecure and dangerous and something a hacker could get around, no?

[@Ashotofcode]

Thanks! Good question - Yes I think you are correct in that the data will be returned - the browsers are pretty solid though so I would think safe - this takes place internally in the browser so not something you can attack with Javascript really. Cheers Mark

[@CryptoJitsu]

@@Ashotofcode thanks!

[@smashed5826]

The explanation was not deep enough, in this video you just explianed CORS is browser security policy stuff and seeing you tried it out for direct access on browser and via ajax call. It could be deeper to explain why browser needs this; what kind of attacks could be implemented if no this security policy on browser; What headers needs to be added to allow browser calls a cors resource, different browsers or same browser with different versions treat different headers to allow CORS; server side API header settings to control the access the resource in different scenarios etc.

[@thisurathenuka8362]

Nice explanation ❤

[@Ashotofcode]

Glad you liked it Thisura :-)

[@unknownqweasd]

it was very helpfull, thank you!

[@Ashotofcode]

Glad it was helpful! Cheers Mark

[@mineralisk]

Thanks for making the video

[@ashwinisidhu]

shot & easy. Thanks

[@iQCudi]

amazing

[@Ashotofcode]

Thank you! Cheers!

[@louisecrowe4968]

Thanks great video :)

[@Ashotofcode]

Glad you liked it Louise. Cheers Mark :-)

[@ganeshk8682]

Thanks..

[@Ashotofcode]

Welcome

[@arfan8544]

Thank You very much. 🤘

[@Ashotofcode]

Thanks SM, glad it was useful 😀

[@jagadeeshg3756]

WoW, Thank you so much!

[@ameyapatil1139]

Excellent ! Thanks !

[@erdemarslan3371]

thx very clear!!

[@Ashotofcode]

Thanks Erdem :-) glad it was useful.

[@ValentinTruta]

Arrow functions return by default if code is on the same line.

[@Ashotofcode]

Nice thanks Valetin!

[@daminduliyanage]

Thank You 👍🏻👍🏻

[@JulienReszka]

audio is very low volume, I wish it wasn't that low

[@tonyj4435]

Thanks bro

[@Ashotofcode]

Welcome 😎

[@addtyu6176]

I closed the video immediately after seeing Microsoft Edge being used....

[@Ashotofcode]

lol fair play :-)

[@trumbaron]

Confusing for me...

[@dartme18]

RIP, SWAPI

[@Ashotofcode]

D'oh yep it has died!

[@dartme18]

@@Ashotofcode Someone posted a duplicate pretty quickly after SWAPI died (that was six months ago I think?). Our company used SWAPI for interview exercises, so we were happy to see the replacement!

[@Ashotofcode]

@@dartme18 Ah yes, swapi.dev, cool thanks!

[@Derekbylck]

=> return

[@Ashotofcode]

Ah yes that one gets me a lot! thanks

[@aravind4444]

please explain with diagram

[@ronaldlogan3525]

very poorly explained, uses tools people may not be familiar with, the actual subject is almost ignored

[@ramiz3570]

+