CORS (Cross-Origin Resource Sharing) uses HTTP headers to let a server permit browser access to responses from another origin. For Joomla, it matters when an external web application requests data or loads certain resources.
Origins and preflight
An origin consists of scheme, host and port. Subdomains or HTTP and HTTPS can therefore have different origins. For some requests, the browser first sends an OPTIONS preflight to check allowed methods and headers.
When rules do not permit access, the browser restricts JavaScript from reading the response. The server may already have received the request, so CORS does not replace authorisation or CSRF protection. Server-side clients need not follow browser CORS restrictions.
Joomla checks
For Joomla integrations, inspect requests from the intended application, preflight and the final response. Headers can originate in the application, web server or proxy. Conflicting duplicate headers can break access.
Credentialed requests cannot simply combine a wildcard origin with permission to include credentials. Allowed origins should match the intended Joomla integration. Diagnose CORS separately from incorrect URLs and server error responses.
Conclusion
CORS controls cross-origin browser access. User permissions, safe request handling and server validation remain separate responsibilities.