CORS is a browser security mechanism controlled by HTTP response headers.

A server can respond with Access-Control-Allow-Origin to indicate which origin may read the response through browser APIs.

Some cross-origin requests trigger a preflight OPTIONS request. The browser asks whether the server permits the intended method and headers. The server responds with appropriate CORS headers.

CORS is primarily a browser enforcement mechanism. It does not replace authentication or server-side authorization.