https://daichangyu.com/en en https://daichangyu.com/en/blog/vmware-fusion-win11-resolution-on-macos-zhihu-2030727323260032019 https://daichangyu.com/en/blog/vmware-fusion-win11-resolution-on-macos-zhihu-2030727323260032019 Admin Thu, 23 Apr 2026 11:30:43 GMT https://daichangyu.com/en/blog/what-is-cors-beginner-guide-zhihu-2030692651218027705 https://daichangyu.com/en/blog/what-is-cors-beginner-guide-zhihu-2030692651218027705 👮‍♂️ **Guard:** "Hold up! You're from Xijiao No. 1 — what gives you the right to walk in here? This is cross-origin. Not allowed!" **📝 Key takeaway** > **Cross-origin**: The browser is like this guard. For safety, the rule is: **unless the other side explicitly agrees, you can't just grab things from another "home" (different domain / protocol / port).** * * * ### 2️⃣ Why block it? (To keep thieves out) The guard may feel overbearing — but without him, the internet would be chaos. Picture this: you just logged into **online banking** (Xijiao No. 1), and then you opened a **phishing site pretending to offer a prize** (Dongjiao Courtyard). Without the guard, that phishing site could sneak into your banking page, steal your login (cookies), impersonate you, and wire your money out. 🛡️ **The guard (the browser) exists to ensure: you can only freely touch things that belong to your own home.** * * * ### 3️⃣ So how do you fetch things from another home? (Three solutions) Sometimes you legitimately need to fetch from a different origin (for example, your page needs weather data from a weather-forecast server). Here are the usual options: ### 🛠️ Method A: The host gives the guard a heads-up (CORS — the standard approach) You (the frontend) want to pick up cake from Dongjiao Courtyard. The host of Dongjiao Courtyard has already told their guard ahead of time: *"Anyone from Xijiao No. 1 is welcome — let them in!"* The guard checks the list, sees you're on it, and waves you through. - 💡 *Technically: the server adds an `Access-Control-Allow-Origin` response header.* ### 🛵 Method B: Send a courier (Proxy — developers' favorite) Worried about the guard? Don't go yourself. You send a **courier (the dev server / Nginx)**. The courier visits your home first, then heads to Dongjiao Courtyard and brings the cake back to you. **The trick:** the guard only stops regular neighbors, not professional couriers. Server-to-server conversations aren't checked by the guard. - 💡 *Technically: the frontend calls its own server, and that server makes the request to the target server.* ### 🕳️ Method C: Sneak through the window (JSONP — legacy) The windows at Dongjiao Courtyard aren't shut properly. You slip a note saying "I want cake" through the window, and they throw the cake back out the same window. This trick only covers very limited cases and is rarely used today. - 💡 *Technically: exploits the fact that `