Web Security · Junior · Question 40 of 75

`fetch('https://api.other.com/data')` fails with a CORS error. Where is it fixed?

✓Correct answer: On the server of api.other.com, by returning the right Access-Control-Allow-* headers
2In the front-end code, by adding mode: 'no-cors' and reading the JSON
3In the browser settings of every user

Explanation

Only the resource owner can allow cross-origin reads. no-cors gives an opaque response that JavaScript can't read.

Further reading

MDN: CORS ↗

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.