Browsers restrict how scripts from one origin interact with resources from another origin. An origin is defined by scheme, host, and port.

For example, https://app.example.com and https://api.example.com are different origins even though they share a parent domain.

The browser's same-origin policy is a security boundary. CORS provides a controlled mechanism through which servers can tell browsers which cross-origin requests may be allowed.