CodePark/ questions / CORS: what it really protects
START PRACTICINGPRACTICE
Frontend question · Frontend security › CORS: what it really protects

This code runs on https://shop.example, and the console shows a CORS error. Did the other server clear the cart?

await fetch("https://api.other.example/cart/clear", {
  method: "POST",
  credentials: "include",
  headers: { "Content-Type": "text/plain" },
  body: "x",
});
// Console: blocked by CORS policy: No 'Access-Control-Allow-Origin' header
Probably yes: this is a simple request, so the browser sent it. CORS only stopped the page from reading the response

A POST with a text/plain body and no custom headers is a simple request. Simple requests need no preflight. The browser sends it, with cookies if their SameSite setting allows it. The server runs the action. Then the browser hides the response from your page. That is the CORS error.

"The browser blocked the request before it was sent" is the tempting wrong answer. That only happens when a preflight is needed and fails, for example with Content-Type: application/json. This is why CORS is not a CSRF defence.