Why CORS matters for APIs in Express - Quick Recap

Recall & Review

beginner

What does CORS stand for and what is its main purpose?

CORS stands for Cross-Origin Resource Sharing. Its main purpose is to allow or block web pages from making requests to a different domain than the one that served the web page, protecting users from malicious sites.

beginner

Why do browsers enforce CORS policies on API requests?

Browsers enforce CORS to prevent malicious websites from reading sensitive data from another site without permission. It acts like a security guard checking if cross-site requests are allowed.

intermediate

How does an Express API enable CORS to allow requests from other domains?

In Express, you can enable CORS by using the 'cors' middleware. This middleware adds the right headers to responses so browsers know which domains are allowed to access the API.

beginner

What happens if an API does not handle CORS properly?

If an API does not handle CORS, browsers will block requests from other domains, causing errors in web apps trying to use that API from a different site.

beginner

Give a simple example of enabling CORS in an Express app.

You can enable CORS by installing the 'cors' package and adding it as middleware: <br><code>const cors = require('cors');<br>app.use(cors());</code><br>This allows all domains to access the API.

What does CORS protect users from?

A Browser crashes

B Slow internet connections

C Malicious websites accessing data from other domains

D Incorrect API responses

CORS protects users by blocking unauthorized cross-domain requests that could steal data.

Which HTTP header is commonly used to control CORS permissions?

A User-Agent

B Content-Type

C Authorization

D Access-Control-Allow-Origin

The 'Access-Control-Allow-Origin' header tells the browser which domains can access the resource.

In Express, which package helps to easily enable CORS?

A express-cors

B cors

C body-parser

D helmet

The 'cors' package is the standard middleware to enable CORS in Express apps.

What will happen if a browser blocks a cross-origin request due to CORS?

A The request fails and the web app cannot access the response

B The request succeeds but with a warning

C The browser crashes

D The server ignores the request

Browsers block the request and prevent the web app from reading the response.

Which of these is NOT a reason to configure CORS on an API?

A Improve API response speed

B Prevent unauthorized cross-site requests

C Allow trusted websites to access the API

D Control which domains can use the API

CORS controls access permissions, it does not affect response speed.

Explain in simple terms why CORS is important for APIs and how it protects users.

Think about how websites can try to get data from other sites without permission.

Describe how you would enable CORS in an Express API and why you might want to do that.

Consider what happens when a web app on one domain tries to call your API on another domain.