CORS
CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls whether a web page on one origin may request resources from another. The server returns Access-Control-Allow-Origin and related headers; if they don't permit the requesting origin, the browser blocks the response. It governs cross-domain fetch, XHR, and direct uploads.
By default, browsers enforce the same-origin policy: scripts on https://app.example can't freely read responses from https://api.other. CORS is the controlled exception. The server explicitly opts in by returning headers that name which origins, methods, and request headers are allowed.
For anything beyond a simple GET — say a PUT upload with a Content-Type header — the browser first sends a preflight OPTIONS request. The server must answer with the matching Access-Control-Allow-Methods and Access-Control-Allow-Headers, or the real request never fires. This is the single most common reason direct browser uploads fail.
Crucially, CORS is enforced by the browser, not the server. A non-browser client (curl, a backend, a mobile SDK) ignores CORS entirely — so a 'CORS error' is always a browser-side configuration problem, not a network failure.
Access-Control-Allow-Origin: https://app.example
Access-Control-Allow-Methods: PUT, GET, OPTIONS
Access-Control-Allow-Headers: Content-Type