CyberCertPrepWeb App FundamentalsFront-end vs Back-endEASYFree question
A developer uses 'fetch()' in a browser and notices it fails with a CORS error when calling their own API. The API is at 'https://api.example.com' and the frontend is at 'https://app.example.com'. Why does this count as cross-origin?
- A.This counts as cross-origin only if the ports differ
- B.Cross-origin only applies when the scheme (http vs https) differs; REST calls from the frontend carry the session automatically only when issued via XMLHttpRequest rather than fetch; the fetch API cannot send credentials cross-origin under any configuration, which is why SSO uses form posts
- C.It does not count as cross-origin since both share the 'example.com' root domain
- D.The Same-Origin Policy defines origin as scheme + hostname + port. 'api.example.com' and 'app.example.com' have different hostnames, making them different origins regardless of sharing a common root domain
Why D is correct
The Same-Origin Policy considers scheme, hostname, and port together as the origin. 'https://api.example.com' and 'https://app.example.com' differ in hostname, making them cross-origin. Subdomains are separate origins under SOP. To allow cross-origin requests between them, the API server must include appropriate CORS headers. Some older APIs incorrectly assumed shared TLDs meant same-origin.
Know someone studying for Web App Fundamentals? Send them this one.