pov: bro does not know about CORS 💀

Hey bro, for some reason the front end of the food ordering website can't access our back-end API's. I know I have the authentication on API key set up correctly. So, do you have any idea what might be up? Yeah, I know exactly what's wrong. Come sit down and I'll explain. All right, dude, here's what's happening. When your friend makes a request to your back-end API's, the browser is actually going to add a header to your call, specifying the origin of that request. All right, that's fine and all. I mean, I saw successful request in the logs of my back-end services. That's right, your back-end doesn't actually care about this. It's going to succeed because you have proper authentication setup and going to give back a proper response code with real data. Okay, but then why is it failing? Now, for additional security, your browser is looking for a certain header with that API response to make sure that that is an allowed domain that your website is intending to access. So I have to add that on the back end. Right, so your back end needs to return a successful response code with a 200 plus a header like this, access control allow origin plus the specific domain name that we're intending to return. And what if I want any website to be able to use my APIs? Well, you could return an access control allow origin star but good getting that through infosack.