A developer says "CORS is blocking my request, so I set `Access-Control-Allow-Origin: *` on the API and it works now." Walk me through what CORS actually did, and what that change means.
Answer it out loud before you open anything. The value of the flags below is in comparing them to what you actually said.
The situation behind the question
An internal API that a new dashboard on a different subdomain needs to call. The API uses cookie-based sessions. The change was made in a config file and shipped the same afternoon.
What it is really testing
Whether the candidate knows what CORS protects and who it protects. Almost every frontend engineer can make a CORS error go away; the discriminator is whether they can say that CORS is a browser policy about *reading responses*, not an access control on the server.