Transport and Browser Security: CORS and CSRF

Seeing a CORS error in the browser can make it seem as though an API request never reached the server. Yet an account setting may already have changed by the time the error appears. The browser blocked access to the response; it did not necessarily prevent the request or its effect.

Transport security, browser response sharing, and protection against forged requests solve different problems.

This chapter explains how HTTPS, CORS, cookies, and CSRF defenses work together, using a bookstore storefront and its API.