Cross-Origin Resource Sharing (CORS) is a set of policies configured in the server side that tells the browser whether the server allows requests generated with script code at external sites (cross-origin requests), and from which sites, or whether it only accepts requests generated in pages hosted by itself (same origin). A correctly configured CORS policy can help in the prevention of Cross Site Request Forgery attacks, and although it is not enough, it can stop some vectors.
In this recipe, we will configure a web service that does not allow cross-origin requests and create a page that is able to send a forged request despite this request.
