Since the request is going to the domain, the browser includes the relevant cookies. The evil site also has the ability send a request to /api. In this case, your browser would store a relevant session cookie for the domain:

For instance, it’s feasible that you would sign into a web app like. This is especially useful for authentication, and setting sessions. In this maneuver, a malicious website attempts to take advantage of the browser’s cookie storage system.įor every HTTP request to a domain, the browser attaches any HTTP cookies associated with that domain. The same-origin policy fights one of the most common cyber attacks out there: cross-site request forgery.

The error stems from a security mechanism that browsers implement called the same-origin policy. To get there, let’s answer a couple questions: Why was the CORS error there in the first place? It wouldn’t be the wisest business decision… In local development, it’s fine to have a plugin installed that can help you get past the error.īut once you publish your application, you can’t expect your users to install the plugin too. However, this fix only applies to your own machine. The plugin definitely addresses the issue. Then refresh your application, and your API requests should now work! 🎉 But the plugin fix is deceiving

Why wont origin install