Frontend Developer interview question
What is CORS and how do you debug it?
CORS is a browser security policy: the server must explicitly allow another origin through response headers. It is not solved in frontend code; inspect the request origin, preflight response, credentials mode, and server headers.
Direct answer
What a strong answer covers
How it works
The browser enforces the same-origin policy: a script may send a request to another origin, but it may only read the response if that origin opts in through Access-Control-Allow-Origin and related headers. Requests with custom headers, non-simple methods, or certain content types trigger an OPTIONS preflight first. Debugging means reading the exact error in the console, then checking the preflight response, the origin echoed back, credentials mode, and whether a proxy or CDN strips the headers.
Example
A credentialed request cannot use Access-Control-Allow-Origin: *; the server must return the exact allowed origin and allow credentials. A common trap is an API that sets the headers on 200 responses only, so a 401 or 500 arrives without them and the browser reports a CORS error that hides the real status.
Common mistakes
- Trying to fix CORS with a header on the request instead of the response.
- Reflecting any Origin value back with credentials enabled, which disables the protection entirely.
- Forgetting that error responses and redirects need the same headers as successful ones.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.