Question 1

Why am I getting a CORS error when calling my API from the browser?

Accepted Answer

The single most useful thing to understand about CORS is that it is enforced by the browser, not by your API. Your server almost certainly responded correctly. The browser made the request, inspected the response headers, decided the page was not allowed to read the result, and threw away a response it had already received. This is why the same endpoint works perfectly from a command line tool and fails from a web page, and why the fix belongs on the server rather than in your client code.

When a page makes a cross-origin request, the browser attaches an Origin header. To let the page read the response, the server must reply with an Access-Control-Allow-Origin header that either matches that origin or is a wildcard.

For anything beyond a simple request, the browser first sends a separate OPTIONS request called a preflight, and only sends the real request if the preflight is approved. Requests become non-simple for ordinary reasons, including sending a JSON content type, using a method such as PUT or DELETE, or attaching a custom header like an API key or bearer token.

That leads to the most common mistake: adding the allow-origin header to normal responses but never handling OPTIONS. The preflight then returns a 404 or a 405, and the real request is never sent at all. The browser console will show the failure against the endpoint even though the OPTIONS call is what actually failed, so check the network tab for a preflight before assuming the main request is at fault.

A second frequent trap involves credentials. If the request sends cookies or authorization credentials, a wildcard origin is rejected outright; the server must echo the specific origin and also send an allow-credentials header.

Disabling web security in the browser or using an extension only hides the problem on one machine, and the deployed site will still fail for everyone else.

Question 2

What is the difference between HTTP 401 and 403?

Accepted Answer

The short version is that 401 concerns identity and 403 concerns permission. A 401 means the request was not authenticated: no credentials were supplied, or the ones supplied were not valid. A 403

Question 3

What is a webhook?

Accepted Answer

An HTTP request sent by a service to you when something happens — the inverse of an API call, and the reason it is sometimes described as a reverse API or a push notification for servers. The problem

Question 4

What is cross-site scripting (XSS)?

Accepted Answer

An attack where attacker-controlled content is executed as JavaScript in another user's browser, in the context of your site — which means it runs with that user's session, cookies and permissions.

Question 5

What is CSRF, and how is it different from XSS?

Accepted Answer

Cross-site request forgery makes a user's browser send a request they did not intend, to a site where they are already authenticated — exploiting the fact that browsers attach cookies automatically

Question 6

Why does my API return 502 Bad Gateway?

Accepted Answer

A 502 is reported by a proxy or load balancer, not by your application. It means the intermediary tried to forward the request to an upstream server and received an invalid response, or none at all.

Question 7

What makes a good API design?

Accepted Answer

Predictability above cleverness — a good API is one where a developer can guess correctly what something is called and how it behaves, because they will guess far more often than they will read the

Related Questions