Test your CORS knowledge with a free interactive quiz — 19 questions with answers and explanations. No signup needed to play.
Question 1/5Score 0
What is the purpose of caching a preflight response via `Access-Control-Max-Age`?
Questions in this quiz
What is the purpose of caching a preflight response via `Access-Control-Max-Age`?
What does `Access-Control-Expose-Headers` control, and why might a frontend need it?
How does a typical Express.js (Node) server configure CORS using the popular `cors` npm package?
What is a "preflight request" in CORS, and when does the browser send one?
Why can't a frontend application simply "fix" a CORS error by changing something in its own client-side JavaScript code?
What is the relationship between CORS and API security more broadly — does correctly configuring CORS headers alone secure an API against malicious requests?
What is the Same-Origin Policy that CORS relaxes, and what problem does it exist to solve?
What HTTP response header does a server use to explicitly allow a specific origin to access its resource via CORS?
What defines an "origin" in the context of CORS/Same-Origin Policy?
What is a reasonable mental model for remembering "who fixes a CORS error" when debugging one?
What is a common development-environment workaround for CORS issues when a frontend dev server and a separate backend API run on different ports locally?
What is CORS (Cross-Origin Resource Sharing)?
Gaps to close?
Read the curated CORS notes — core concepts, patterns, interview prep.