Is CORS a security control that protects your API from attackers?
Options
- Yes, it blocks all of the unauthorized clients
- No. It only tells browsers which origins may read (Correct option)
- Yes, it encrypts the responses sent by the API
- Yes, but only for the GET requests of the API
Answer
No. It only governs which origins a browser lets read responses; attackers can call your API directly with curl
Why
CORS rules are enforced only by browsers, to protect users from malicious websites reading data on their behalf.
An attacker can simply call your API with curl, Python or Postman, where CORS does not exist.
Your API is protected by authentication, authorization and rate limiting. CORS is still important to configure correctly, so it doesn't weaken browser protections.
Remember
CORS protects browser users, not your API.