Subressursforespørsler

Subressursforespørsler, often abbreviated as CSR for Cross-Origin Resource Sharing, is a mechanism that allows many resources, such as JavaScript, that are loaded from a web page to be requested from a domain different from the one that served the web page. It is a security feature implemented by web browsers. By default, browsers restrict web pages from making requests to a different origin than the one the page originated from. This is known as the same-origin policy.

When a web page needs to fetch a resource from another domain, such as an API endpoint or an image hosted on a different server, it must do so in a way that is permitted by the server hosting the resource. CSR defines a way for servers to indicate which origins are allowed to access their resources. This is typically done through HTTP headers sent by the server. The server can specify which origins are permitted to make requests, which HTTP methods (like GET, POST, PUT, DELETE) are allowed, and which headers can be used in the request.

If the server does not explicitly permit the request from the originating domain, the browser will block the request and typically log an error in the developer console. This prevents malicious websites from making requests on behalf of a user to other sites the user is logged into, thereby protecting sensitive data. Implementing CSR correctly is crucial for web applications that rely on resources from multiple domains.