What is CORS?
Browser rules that decide which websites may call an API.
Cross-Origin Resource Sharing — the HTTP-header mechanism that lets a page on origin A call an API on origin B. If the API doesn't opt in with headers like Access-Control-Allow-Origin, the browser blocks the response even though the request itself succeeded.
api.example.com returning Access-Control-Allow-Origin: https://app.example.com