Paths/Backend Engineer/HTTP & Networking / Headers & Caching
Configure CORS Properly
CORS is a browser feature, and the most common way to break it is to answer every origin. Write the configuration that is open where it must be and closed where it must be.
Validator
IDLE — checks run live as you type commands; submit when done
01Requirements
live checks- File ~/http/cors.yaml exists○
- The file states the allowed origins○
- The file states the allowed methods and headers○
- The file states the credentials rule and the preflight cache○
02Walkthrough
1 of 3 revealed- 01
Write the allowed origins
Name the origins you actually serve. A wildcard with credentials is rejected by the browser, so the two settings have to agree.
echo 'cors:\n allowed_origins:\n - https://app.acme.com\n - https://checkout.acme.com\n credentials: true\n max_age: 600' > ~/http/cors.yaml - 2 locked · each failed submit reveals one
03Stuck?
0 of 3 revealedTake a hint without losing the lab — each one points at the thing to look at, not at the answer.
04AI Tutor
guides, never solvesTell me what you're stuck on — I'll nudge, not solve. Which requirement are you looking at?
04Notebook
saved locally in this browserlearner@lab — ubuntu:24.04
Session is disposable
↑/↓ recalls commands · Ctrl+Enter submits · type help for the command list