Concept questionMedium~7 min

Interview question

What causes a CORS preflight request, and how would you configure browser access to an ASP.NET Core API safely?

CORS preflight and browser API access

Explains browser same-origin enforcement, preflight requests, credentials, middleware behavior, and why CORS is not authorization.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

A browser can send some simple cross-origin requests directly, but a non-simple method, header, or content type causes an OPTIONS preflight first. The browser asks whether the origin, method, and headers are allowed. The API returns the appropriate Access-Control-Allow headers, and the browser decides whether the actual request may proceed. I configure an explicit origin allowlist, required methods and headers, and place ASP.NET Core CORS middleware in the documented pipeline position.

Full answer below

Practice focus

Origins, same-origin policy, simple requests, OPTIONS preflight, allowed methods and headers, credentials, middleware order, and Vary.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
CORS is a browser access rule around cross-origin JavaScript. It is often mistaken for authentication or a server-to-server firewall, which leads to both broken frontends and weak security assumptions.
A browser can send some simple cross-origin requests directly, but a non-simple method, header, or content type causes an OPTIONS preflight first. The browser asks whether the origin, method, and headers are allowed. The API returns the appropriate Access-Control-Allow headers, and the browser decides whether the actual request may proceed. I configure an explicit origin allowlist, required methods and headers, and place ASP.NET Core CORS middleware in the documented pipeline position.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
Credentials make the policy stricter. A credentialed response cannot use a wildcard allowed origin; the server must return the allowed requesting origin and permit credentials intentionally. CORS does not prove identity or permission, so the endpoint still authenticates and authorizes every request. Server-to-server clients are not protected by browser CORS enforcement. I also make sure authentication middleware does not turn preflight into an unrelated login failure before the CORS policy can answer it.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I derive allowed origins from reviewed configuration rather than reflecting any Origin value. Reverse proxies, custom domains, preview environments, and ports are part of the exact origin and need deliberate lifecycle ownership. Responses that vary by Origin need correct cache behavior so a CDN does not reuse one origin's permission for another. I test the real browser flow for allowed and denied origins, preflight caching, custom headers, cookies, authorization failures, and direct non-browser calls. Logs capture origin and policy outcome without treating a blocked browser read as proof the API request never reached infrastructure.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Using CORS as the endpoint's authorization mechanism.
Allowing any origin together with credentials.
Reflecting the Origin header without checking an allowlist.
Testing only with Postman or curl and assuming the browser will behave the same.

Red flagsCandidateSigns the approach is fragileSignals that an interviewer may treat as risky.Open details

Details

Production origins are added through emergency wildcard changes.
Preflight requests are challenged by authentication before policy evaluation.
A CDN can cache one origin's allow response for another origin.
The team thinks CORS blocks server-to-server abuse.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

What makes a request non-simple?
Why can credentials not be combined with a wildcard origin?
Where should CORS middleware run?

Continue practice

Move to the linked follow-up, next path step, prerequisite, or deeper variant.

1 linked

Go deeper

Practice the next layer of the same subject.

Browser Auth Security

Opening drill

Concept questionMedium~7 min

Interview question

What causes a CORS preflight request, and how would you configure browser access to an ASP.NET Core API safely?

CORS preflight and browser API access

Explains browser same-origin enforcement, preflight requests, credentials, middleware behavior, and why CORS is not authorization.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

Origins, same-origin policy, simple requests, OPTIONS preflight, allowed methods and headers, credentials, middleware order, and Vary.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
CORS is a browser access rule around cross-origin JavaScript. It is often mistaken for authentication or a server-to-server firewall, which leads to both broken frontends and weak security assumptions.
A browser can send some simple cross-origin requests directly, but a non-simple method, header, or content type causes an OPTIONS preflight first. The browser asks whether the origin, method, and headers are allowed. The API returns the appropriate Access-Control-Allow headers, and the browser decides whether the actual request may proceed. I configure an explicit origin allowlist, required methods and headers, and place ASP.NET Core CORS middleware in the documented pipeline position.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
Credentials make the policy stricter. A credentialed response cannot use a wildcard allowed origin; the server must return the allowed requesting origin and permit credentials intentionally. CORS does not prove identity or permission, so the endpoint still authenticates and authorizes every request. Server-to-server clients are not protected by browser CORS enforcement. I also make sure authentication middleware does not turn preflight into an unrelated login failure before the CORS policy can answer it.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I derive allowed origins from reviewed configuration rather than reflecting any Origin value. Reverse proxies, custom domains, preview environments, and ports are part of the exact origin and need deliberate lifecycle ownership. Responses that vary by Origin need correct cache behavior so a CDN does not reuse one origin's permission for another. I test the real browser flow for allowed and denied origins, preflight caching, custom headers, cookies, authorization failures, and direct non-browser calls. Logs capture origin and policy outcome without treating a blocked browser read as proof the API request never reached infrastructure.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Using CORS as the endpoint's authorization mechanism.
Allowing any origin together with credentials.
Reflecting the Origin header without checking an allowlist.
Testing only with Postman or curl and assuming the browser will behave the same.

Red flagsCandidateSigns the approach is fragileSignals that an interviewer may treat as risky.Open details

Details

Production origins are added through emergency wildcard changes.
Preflight requests are challenged by authentication before policy evaluation.
A CDN can cache one origin's allow response for another origin.
The team thinks CORS blocks server-to-server abuse.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

What makes a request non-simple?
Why can credentials not be combined with a wildcard origin?
Where should CORS middleware run?

Continue practice

Move to the linked follow-up, next path step, prerequisite, or deeper variant.

1 linked

Go deeper

Practice the next layer of the same subject.

Browser Auth Security

What causes a CORS preflight request, and how would you configure browser access to an ASP.NET Core API safely?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

Go deeper

What causes a CORS preflight request, and how would you configure browser access to an ASP.NET Core API safely?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

Go deeper