CORS

CORS (Cross-Origin Resource Sharing) is the browser mechanism that controls whether a web page may use files and data from a different domain than its own. The server hosting the file must explicitly permit other sites to use it via CORS HTTP headers, otherwise the browser blocks the request - a common cause of fonts and scripts failing to load.

CORS exists as a safety default: without it, any website could quietly read data from another site a visitor happens to be logged into. A missing or misconfigured CORS header does not break the source file itself, only the ability of other origins to use it - which is why the same font or script can work fine on one domain and silently fail to load on another.

Learn more

• Fetch: CORS protocol - the WHATWG specification
• HTTP header