CORS

Cross-origin resource sharing allows you to expose APIs to web applications running in other domains.

By default web apps only have access to resources running in their own domain. For obvious reasons: we don't want a web page in evil.com to be able to make an AJAX POST to https://gmail.com/messages/send carrying the cookies you have for your gmail account.

Since Pliny don't rely on cookies, it does expose all endpoints to other web sites via CORS. This means web pages running in a browser can call your APIs just like any other client – as long as they provide the same credentials you require elsewhere, of course.

Further reading:

• CORS middleware in Pliny
• Wikipedia