A deep, practical reference for CORS, preflight requests, and browser cross-origin security.
www.cross-origin.com
cross-origin.com is a free, in-depth technical reference for developers and security engineers who work with cross-origin communication every day. It takes the parts of the web platform that most people learn by trial and error — the Same-Origin Policy, CORS headers, preflight negotiation, credentialed requests, and the proxy layers in between — and explains them clearly, with worked examples grounded in the WHATWG Fetch and W3C specifications.
Every page is written to answer a real question you might hit in production: why did the browser block this request, and exactly what do I change to fix it?
The reference is organised into four in-depth areas:
- Core CORS Mechanics & Same-Origin Policy Fundamentals — origin tuples, simple vs. preflight requests, credential isolation, and how browsers actually evaluate the Same-Origin Policy.
- Preflight Request Optimization & Caching —
tuning
Access-Control-Max-Age, cutting preflight frequency, designing lightweightOPTIONSendpoints, and measuring real-world latency. - Server-Side CORS Configuration & Header Management —
dynamic origin validation,
Vary: Origin, wildcard risks, credential sync across subdomains, and security auditing. - Cross-Origin Debugging & Error Diagnosis — decoding browser error messages, reading preflight requests in DevTools, reproducing failures with curl, and untangling proxy-layer problems behind CDNs.
CORS errors are one of the most common — and most misunderstood — obstacles in modern web development. The official specs are precise but dense, and most tutorials stop at "just add a wildcard header," which is often wrong and sometimes insecure. This reference aims to be the resource that actually explains the mechanics, so you can fix the root cause with confidence and without opening a security hole.
- Eleventy — static site generation from Markdown + Nunjucks
- Cloudflare Pages — global edge hosting
- Hand-authored SVG diagrams, structured data (JSON-LD), and a PWA manifest for offline reading
npm install
npx @11ty/eleventy --serveThe site builds to _site/. Open the printed local URL to preview.
Spotted an inaccuracy, a broken example, or a gap in coverage? Issues and pull requests are welcome — corrections to the technical content are especially appreciated.