CORS can be used to define exceptions to the same-origin-policy. By default, the same-origin-policy doesn't allow all requests to other origins (domains/websit

CORS can be used to define exceptions to the same-origin-policy. By default, the same-origin-policy doesn't allow all requests to other origins (domains/websites/ports). But if you want to allow another website to send requests to your site you can use CORS to do so. So for example, if you have a contact form on one page (example.com) and the API for processing the submitted forms on another domain (processing.com; different origin), the receiving server tells the browsers via CORS that submissions from example.com are allowed.