intermediateCORS: Cross-Origin Resource Sharing

Is CORS a substitute for authentication/authorization?

No — CORS only controls whether a BROWSER will let cross-origin JavaScript read a response; it says nothing about who is allowed to access the data. A properly secured API still needs its own authentication and authorization regardless of CORS configuration, since non-browser clients ignore CORS entirely.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to What is a CSRF attack, and why does it work even without the attacker knowing your password? →← Back to all Spring Security questions