CORS.
A bouncer who phones the other building first: “is this guest allowed to talk to you?” before a page calls another site.
- 1
A page from one site wants to call another site’s API — a different “origin.”
- Different building — hold on.2
Your browser is the bouncer: same-origin walks in; cross-origin gets a second look.
- Is this guest on the list?3
For risky calls, the browser phones ahead first (a “preflight”): is this allowed?
- Yes — they’re welcome.4
The other site answers with its guest list — which origins it allows.
- 5
On the list? The real request goes through and the data comes back.
- Blocked by CORS policy.6
Not on the list? The browser blocks it and logs a CORS error — even though the server was fine.
Semicolony semicolony.dev/eli5/cors/comic