Proxy it or fix CORS?

• quiz
• medium
• server
• 10 min
• server-proxy
• mark done

Every frontend team hits this in week one and half of them ship the workaround.

Your browser blocks a request to api.example.com with a CORS error. Where is the fix?

• A Add a header to your fetch() call
• B On the API server, which must send Access-Control-Allow-Origin
• C Disable CORS in the browser
• D Use XMLHttpRequest instead of fetch

A dev-server proxy forwarding /api to api.example.com makes the error disappear. What just happened?

• A The proxy added the CORS headers
• B The request is now same-origin, so the browser never applies CORS at all
• C CORS was disabled
• D The proxy cached the response

Your app sends a JSON body with an Authorization header. The browser makes an OPTIONS request first. Why?

• A A bug in the fetch polyfill
• B It is a preflight: a custom header makes the request non-simple, so the browser asks permission before sending it
• C The server requested it
• D It is checking whether the server is alive

You want cookies sent to the API on a different origin. What is required?

• A credentials: 'include' on the request only
• B credentials: 'include', plus Access-Control-Allow-Credentials: true and an explicit origin — the wildcard is rejected — plus SameSite=None; Secure on the cookie
• C Nothing, cookies always go
• D Move the cookie to localStorage

Related

• Reading: Proxy · API · Protocol · Authentication
• Agent Skill: server-proxy