CORS Explained: The Browser Security Model You're Actually Fighting

Every backend engineer eventually gets a frantic message from a frontend dev: 'CORS is broken, please fix it.' What they actually mean is 'the browser is enforcing the same-origin policy and our code isn't telling it that this request is allowed.' Once you understand what CORS *is* -- and what it isn't -- the cryptic preflight failures stop being a mystery.