CORS configuration with Flask-CORS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CORS stand for and why is it important in web development?

CORS stands for Cross-Origin Resource Sharing. It is important because it controls how resources on a web server can be requested from another domain, helping to keep web applications secure by restricting unwanted cross-origin requests.

beginner

How do you enable CORS for all routes in a Flask app using Flask-CORS?

You import CORS from flask_cors and then call CORS(app) after creating your Flask app. This allows all routes to accept cross-origin requests.

intermediate

What is the purpose of the 'resources' parameter in Flask-CORS configuration?

The 'resources' parameter lets you specify which routes or URL patterns should have CORS enabled. You can limit CORS to certain endpoints instead of enabling it globally.

intermediate

How can you restrict CORS to only allow requests from specific origins in Flask-CORS?

You use the 'origins' parameter in the CORS function to list allowed domains. For example, CORS(app, origins=['https://example.com']) only allows requests from that domain.

intermediate

What HTTP headers does Flask-CORS automatically handle to support CORS?

Flask-CORS automatically adds headers like 'Access-Control-Allow-Origin', 'Access-Control-Allow-Methods', and 'Access-Control-Allow-Headers' to responses to enable cross-origin requests.

Which Flask-CORS function call enables CORS for the entire Flask app?

A CORS(app)

B enable_cors(app)

C app.enable_cors()

D cors_enable(app)

The correct way is to import CORS from flask_cors and call CORS(app) to enable CORS globally.

How do you allow only 'https://mydomain.com' to access your Flask API using Flask-CORS?

A CORS(app, origins=['https://mydomain.com'])

B CORS(app, allow=['https://mydomain.com'])

C CORS(app, domains=['https://mydomain.com'])

D CORS(app, hosts=['https://mydomain.com'])

The 'origins' parameter is used to specify allowed domains.

What does the 'resources' parameter in Flask-CORS do?

A Defines the HTTP methods allowed

B Specifies which routes have CORS enabled

C Sets the allowed headers

D Configures the server port

'resources' lets you target specific URL patterns for CORS.

Which HTTP header is NOT automatically handled by Flask-CORS?

A Access-Control-Allow-Origin

B Access-Control-Allow-Methods

C Access-Control-Allow-Headers

D Content-Security-Policy

Content-Security-Policy is unrelated to CORS and not handled by Flask-CORS.

If you want to enable CORS only on the '/api/data' route, how would you configure Flask-CORS?

A CORS(app, only='/api/data')

B CORS(app, route='/api/data')

C CORS(app, resources={r'/api/data': {'origins': '*'}})

D CORS(app, path='/api/data')

The 'resources' parameter accepts a dictionary with route patterns as keys.

Explain how to set up Flask-CORS to allow cross-origin requests only from a specific domain for certain routes.

Think about how to combine 'resources' and 'origins' parameters.

Describe what CORS is and why Flask-CORS is useful in a Flask web application.

Focus on the problem CORS solves and how Flask-CORS helps.