Test your CORS knowledge with a free interactive quiz — 19 questions with answers and explanations. No signup needed to play.
Question 1/12Score 0
What is CORS (Cross-Origin Resource Sharing)?
In this round
What is CORS (Cross-Origin Resource Sharing)?
What is the relationship between CORS and API security more broadly — does correctly configuring CORS headers alone secure an API against malicious requests?
What is the significance of a CORS error appearing in the browser console, specifically regarding whether the actual request reached the server?
What does `Access-Control-Allow-Credentials: true` (paired with a specific, non-wildcard `Access-Control-Allow-Origin`) enable?
What is a "simple request" in CORS terminology, and what criteria must a request meet to qualify (and thus skip preflight)?
What is the Same-Origin Policy that CORS relaxes, and what problem does it exist to solve?
What is a "preflight request" in CORS, and when does the browser send one?
How does a typical Express.js (Node) server configure CORS using the popular `cors` npm package?
What is a reasonable mental model for remembering "who fixes a CORS error" when debugging one?
What defines an "origin" in the context of CORS/Same-Origin Policy?
What is a common development-environment workaround for CORS issues when a frontend dev server and a separate backend API run on different ports locally?
What is the purpose of caching a preflight response via `Access-Control-Max-Age`?
Gaps to close?
Read the curated CORS notes — core concepts, patterns, interview prep.