Why browsers need CORS

What this card says

Why do we need it?

curl works; the browser blocks. Students think the API is down.

What is it?

Same-Origin Policy. Cross-origin calls need Access-Control-Allow-* headers.

How to do it

Enable CORS on the HTTP API; return Allow-Origin in Lambda too for proxy.

Access-Control-Allow-Origin

Example

UI on CloudFront, API on execute-api → both origins differ → CORS required.