Web Security · Junior · Question 41 of 75

Does CORS protect your API from attackers using curl or a script on their own server?

1Yes, as long as Access-Control-Allow-Origin isn't *
✓Correct answer: No: CORS is enforced only by browsers, so the API still needs authentication and authorization
3Yes, CORS blocks every request without a valid Origin

Explanation

CORS protects users' browsers from other websites reading data with their credentials. Non-browser clients ignore it completely.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.