Why did the browser block that fetch?

Briefing

A cross-origin fetch returns a CORS error in the console, yet the server logged the request and returned data. What exactly did the browser stop?

The network tab shows a 200. Your code sees an error. Both are correct, and the difference is the whole security model.

Laboratory

Security Lab

Level

SYSTEMS

Estimated time

11 minutes

Method

interactive

Variables under observation

same-origin policyCORScredentialsSameSiteorigin