Notes
Same Origin Policy prevents one origin from accessing resources on a different origin, this includes JavaScript & HTTP Requests.
Requests made by http://a.com/latest
| URL | Result | Reason |
| https://a.com/myInfo | Allowed | Same Origin |
| **http:**//a.com/users.json | Blocked | Different Schema and Port |
| https://**api**.a.com/info | Blocked | Different Domain |
| https://a.com**:8443**/file | Blocked | Different port |
| https://**b**.com/analytics | Blocked | Different Domain |
Please note images and iframes are always allowed.
CORS headers start with “Access-Control”
Access-Control-Allow-Origin
Describes which origin can access the response. It's the most improtant, because it's the whitelist of what origins can access resources at this host.
[[ *, an origin, or “null” ]] is open for that request's host.
Access-Control-Allow-Credentials
Indicates if the request can include credentials ← !!!!
Access-Control-Expose-Headers
Instructs the browser to expose certain headers to JavaScript.
Access-Control-Max-Age
Instructs the browser to cache the CORS configuration for X seconds.
Standard GET, HEAD, and POST requests don't require preflight requests.
Other request methods, requests with custom HTTP headers, or POST requests with non-standard content-types will require a preflight request.
Using the HTTP method OPTIONS for a request lets you know what methods are accepted.