CORS (Fetch Standard)

1. CORS protocol

   Origin and Access-Control-* headers governing cross-origin requests.

2. CORS protocol and credentials

   Why wildcard origins are disallowed when credentials are included.

3. CORS-safelisted methods and headers

   Simple requests that skip preflight.

4. CORS-preflight fetch

   OPTIONS preflight with Access-Control-Request-Method/Headers.

5. CORS-preflight cache

   Access-Control-Max-Age and preflight caching.

6. CORS check

   How the browser validates Access-Control-Allow-Origin and credentials.

7. CORS protocol exceptions

   Legacy behaviors that deviate from the CORS protocol.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.