Cross-Origin Resource Sharing - Arthur Dick

Monday, June 23rd, 2025

In the world of web development, Cross-Origin Resource Sharing (CORS) has become a fundamental concept, particularly as applications have evolved to rely on resources from various domains. CORS plays a crucial role in ensuring the security and integrity of web applications by controlling access to resources across different origins. In this comprehensive guide, we'll delve into what CORS is, why it's essential, and how to implement it with PHP.

Understanding CORS

Cross-Origin Resource Sharing (CORS) is a security feature implemented by web browsers to restrict cross-origin HTTP requests initiated from scripts running on a web page. An "origin" is a combination of the protocol, domain, and port of a web application. When a web application makes a request for a resource from a different origin (domain, protocol, or port), the browser enforces CORS policies to determine whether the request should be allowed or denied.

The CORS mechanism involves the browser and the server exchanging specific HTTP headers to determine whether the cross-origin request should be permitted. These headers include:

• Origin Header: Sent by the browser, indicating the origin of the requesting resource.
• Access-Control-Allow-Origin Header: Sent by the server, specifying which origins are allowed to access the resource.
• Access-Control-Allow-Methods Header: Sent by the server, indicating which HTTP methods are allowed when accessing the resource.
• Access-Control-Allow-Headers Header: Sent by the server, specifying which headers are allowed in the actual request.
• Access-Control-Allow-Credentials Header: Sent by the server, indicating whether credentials (such as cookies or HTTP authentication) should be included in the request.
• Access-Control-Expose-Headers Header: Sent by the server, specifying which headers are exposed to the browser.

It's important to note that CORS is enforced by web browsers and does not affect server-to-server communication or non-browser-based HTTP requests.

Why CORS Matters

CORS is crucial for web security because it prevents malicious websites from making unauthorized requests to sensitive resources on other domains. Without CORS restrictions, a malicious script running on one website could potentially access sensitive data or perform actions on behalf of the user on another website.

By enforcing CORS policies, web developers can control which external origins are permitted to access their resources, thereby mitigating the risk of cross-site request forgery (CSRF) attacks and unauthorized data access.

Implementing CORS with PHP

<?php
// Allow requests from example.com
header("Access-Control-Allow-Origin: https://example.com");

// Handle preflight requests
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    header("Access-Control-Allow-Methods: POST, GET, OPTIONS");
    header("Access-Control-Allow-Headers: Content-Type");
    exit(0);
}

// Handle actual requests
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    // Your GET request handling logic here
    echo "GET request received";
} elseif ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Your POST request handling logic here
    $data = json_decode(file_get_contents('php://input'), true);
    echo "POST request received with data: " . json_encode($data);
} else {
    // Handle unsupported request methods
    http_response_code(405);
    echo "Method Not Allowed";
}

Explanation of the code:

1. The Access-Control-Allow-Origin header is set to https://example.com to allow requests from example.com. You can replace it with any specific origins, or * to allow requests from any origin.
2. The code checks if the request method is OPTIONS, which indicates a preflight request. If it is, the server responds with the appropriate CORS headers specifying the allowed methods and headers, and then exits.
3. If the request method is GET or POST, the server processes the request as usual and responds accordingly.
4. If the request method is not OPTIONS, GET, or POST, the server responds with a 405 Method Not Allowed status code.

Conclusion

Cross-Origin Resource Sharing (CORS) is a critical security mechanism that helps protect web applications from unauthorized access and data breaches. By understanding how CORS works and implementing it correctly, developers can ensure the integrity and security of their web applications. In this guide, we've covered the basics of CORS and provided a PHP sample code for implementing CORS policies in your applications. By following best practices and staying informed about CORS updates, developers can build robust and secure web applications that adhere to modern security standards.

Tags: web developmentCORS

← The Creeping PerilBlog Index ↑