Episode 02 game · Raiden · Lightning

Raiden’s Gate

Your app on localhost:3000 calls an API on another origin. Set the server’s response headers so four requests get through the browser’s gate, without opening it to everyone.

RaidenYour app is on localhost:3000 and the API lives on another origin. Set the server’s headers, then send the request through my gate.
02Seal 02
Your apphttp://localhost:3000
BrowserRaiden checks CORS
API serverapi.shopkart.dev
Request 1 of 4

Load the product list


    
    

      
      
      
    

    
    
    
    Blocked by the gate 0
    
  
    
  
    
    
    Server response headers
      
    Access-Control-Allow-Origin
    
      
    Access-Control-Allow-Methods
    
      
    Access-Control-Allow-Headers
    
      
    Access-Control-Allow-Credentials
    
    
    
    
    What the server sends back with each response:
    
    
    
  
    

    
    
    
    Postman is a courier
    It sends the request and shows the reply. It never checks CORS.
    The browser is a gatekeeper
    Your code may only read a cross-origin reply if the server says so.
    The fix lives on the server
    Headers like Access-Control-Allow-Origin. 'no-cors' just hides the data.