Cross-Origin Resource Sharing (CORS)
The most important application of this OPTIONS method is Cross-Origin Resource Sharing (CORS). Initially, browser security prevented the client from making cross-origin requests. It means a site loaded with the www.foo.com URL can only make API calls to that host. If the client code needs to request files or data from www.bar.com, then the second server, bar.com, should have a mechanism to recognize foo.com to get its resources.
The following is the diagram depicting the CORS process:
Let's examine the steps followed in the preceding CORS diagram:
- foo.com requests the OPTIONS method on bar.com
- bar.com sends a header like Access-Control-Allow-Origin: http://foo.com in response to the client
- Next, foo.com can access the resources on bar.com without any restrictions that call any REST method
If bar.com feels like supplying resources to any host after one initial request, it can set the access control to *.
In the next section, we see why the REST API plays such a major role in the next generation of web services. SPAs made it possible to leverage APIs for all purposes, including the UI, clients, and so on.