CORS explained.
CORS (Cross-Origin Resource Sharing) is the browser rule set that lets a page on one origin send a fetch or XHR request to an API on another origin, using response headers to grant permission.
How CORS works
By default a browser enforces the same-origin policy, which stops JavaScript on one origin (a scheme, host and port, like https://yoursite.com) from reading responses off another. That protects users, but it also blocks legitimate calls, such as your site's fetch request to an API on a different domain. CORS is the agreed way to relax that safely.
When your script makes a cross-origin request, the browser attaches an Origin header naming where the call came from, and the server answers with an Access-Control-Allow-Origin header saying which origins it trusts. If your origin is allowed, the browser hands the response to your code, otherwise it blocks it. For anything beyond a simple request the browser first sends a preflight, an automatic OPTIONS check that asks permission before the real call goes out. Crucially, CORS is enforced by the browser, not the server, and it governs whether your script may read the response.
For a form backend this is why a fetch submission to the endpoint just works: FormWire returns permissive CORS headers, so a script on any static site can POST to the endpoint and read the result without a proxy of your own.
What CORS decides.
Crosses origins safely
It is the sanctioned exception to the same-origin policy, letting your page call an API on another domain when that server opts in.
Permission by header
The server's Access-Control-Allow-Origin response header names who may read the reply, so the browser knows to allow or block it.
Preflight for complex calls
For non-simple requests the browser sends an automatic OPTIONS check first, confirming the real call is welcome before sending it.
Related questions
Because your script tried to read a cross-origin response and the server did not return a matching Access-Control-Allow-Origin header. The request often reaches the server fine; it is the browser that blocks your code from reading the reply. The fix is on the server, which must allow your origin.
Not for the server. CORS is enforced by the browser to protect the user, and it governs whether in-page JavaScript may read a response. A non-browser client like curl ignores it entirely, so it is not a substitute for real authentication or authorisation on the server.
For anything past a simple request, the browser first sends an automatic OPTIONS call asking the server which methods and headers it permits. Only if that check passes does the actual request go out, which is why a POST can trigger two requests on the wire.
The preflight request, defined →No. FormWire returns the CORS headers that let a browser POST to its endpoint from any origin, so a fetch call from your static site is allowed to read the result. You point the request at the endpoint and the cross-origin handshake is already handled for you.
Want to see it working?
Read the docsPost to your endpoint from any origin.
Free tier forever. No credit card required.