CORS · Cross-Origin Resource Sharing

Understand the idea

An origin includes scheme, host, and port. localhost:5173 and localhost:8082 differ. Headers such as Authorization and JSON content can trigger an OPTIONS preflight. The backend explicitly permits the frontend origin, methods, and headers.

A concrete example

React origin: http://localhost:5173
API origin:   http://localhost:8082

In the application

SecurityConfig integrates CORS before authentication so the browser can complete preflight for the React API calls.

CORS is not a replacement for authentication or ownership checks. Postman does not enforce the browser’s CORS policy.

Related concepts

• CSRF · Cross-Site Request Forgery
• React
• Authentication