CORS: what it is and why the browser blocks an API
CORS is not a mechanism that simply blocks connections to an API. It is a browser protocol built on the same-origin policy that decides whether JavaScript from one origin may read a response from another origin. In some cases the HTTP request is sent and the browser only blocks script access to the response. In other cases the browser sends an OPTIONS preflight first and uses its result to decide whether the actual request may be sent at all.

