CORS (Cross-Origin Resource Sharing) is a browser security mechanism that restricts web pages from making requests to a different domain than the one that served the web page. It uses HTTP headers to allow servers to indicate which origins are permitted to read the response.

A CORS error occurs when your frontend code tries to fetch a resource from a different origin, and the server does not respond with the appropriate Access-Control-Allow-Origin header. Browsers block the response to protect user data.

A CORS proxy is a server that adds missing CORS headers to the response. Your request is sent to the proxy, which forwards it to the target server and returns the result with Access-Control-Allow-Origin: *, bypassing the browser's same-origin policy. Use public proxies only for non-sensitive testing.

Before sending a "non-simple" request (e.g., with custom headers or methods other than GET/HEAD/POST), the browser automatically sends an OPTIONS request to check if the server allows the actual request. This is called a preflight. If the server doesn't respond with the correct CORS headers, the actual request is never sent.

Add the Access-Control-Allow-Origin header to your server responses. For preflighted requests, you also need to handle OPTIONS requests and return appropriate Access-Control-Allow-Methods and Access-Control-Allow-Headers.

Simple requests use only GET, HEAD, POST with standard headers and content types. They don't trigger a preflight. Any other request (like PUT, DELETE, or custom headers) triggers a preflight OPTIONS check, making them slower and potentially blocked if the server isn't configured correctly.