Browser & Web Performance · Middle · Question 52 of 75

Does a CORS error mean the request never reached the server?

✓Correct answer: Not necessarily: simple requests are sent and processed; the browser just hides the response from the script
2Yes, the browser always blocks the request before sending
3Yes, the server rejects it automatically

Explanation

That's why CORS isn't a CSRF defense: a cross-site form POST can still change state on the server.

Further reading

Test yourself

Take the Browser & Web Performance · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.