api-design
Designing API CORS Headers: When to Allow Cross-Origin Requests and When to Refuse
CORS is the browser policy that controls which origins can call your API from JavaScript. Get it wrong in the permissive direction and you create CSRF vulnerabilities; get it wrong in the restrictive direction and customers cannot integrate from browsers at all.