Progressive Web Application Development by Example

Handling cross-origin requests

You may also need to address a URL on a separate domain. Because of potential security holes, access to these URLs is often protected. You can access these URLs using Cross-Origin Resource Sharing (CORS), an additional layer, which relies on headers to control access.

It is up to the server to tell the browser if it is alright for the browser to access the resource. CORS is a protocol that enables these cross-origin requests. There are actually two requests required to complete a cross-origin request. The first is a pre-flight request (https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Preflighted_requests) where the server tells the browser that the request is approved. After that, the original request ...