Backend concept

CORS & Browser Boundaries

Browser cross-origin read permissions, preflight requests, credentials, exposed headers, and cache variation.

Why this matters

CORS is not server authorization; it is a browser boundary that can leak authenticated responses when misconfigured.

Practice exact allowlists, credential rules, OPTIONS handling, and Vary: Origin.

0 active misses 0 reviewed 0 games completed

No local review items for this concept yet.

Explain when browsers send CORS preflight requests.
Choose safe Access-Control headers for origins, credentials, methods, and headers.
Avoid common CORS mistakes such as wildcard credentials and unsafe origin reflection.
Separate authentication failures from authorization failures.
Recognize token expiration, missing scopes, CSRF risk, and session fixation risk.
Apply object-level authorization instead of trusting a valid token alone.

Reflecting any Origin header for sensitive authenticated APIs.
Combining wildcard origins with credentials.
Forgetting Vary: Origin when CORS responses differ by origin.
Putting response headers in Access-Control-Allow-Headers instead of Access-Control-Expose-Headers.
Treating a valid JWT signature as permission for every object or action.
Returning 401 for authenticated users who lack scope or ownership.

Start with the first game, then use local review history to revisit missed decisions.

APIs Intermediate

Guide browser API requests through CORS decisions covering origins, preflight, credentials, exposed headers, and cache safety.

Auth Intermediate

Inspect authentication scenarios and choose safe backend decisions for tokens, scopes, sessions, CSRF, and object-level authorization.

APIs Beginner

Choose the correct HTTP status code for realistic backend scenarios and learn the response semantics behind each answer.