CORS

Cross-origin resource sharing allows you to expose APIs to web applications running in other domains.

By default web apps only have access to resources running in their own domain. For obvious reasons: we don't want evil.com to be able to make a POST request to https://gmail.com/messages/send, at least not if this request will carry your Gmail cookies.

Since Pliny don't rely on cookies, it does expose all endpoints to other web sites via CORS. This means web pages running in a browser can call your APIs just like any other client – as long as they provide the same credentials you require elsewhere, of course.

More info:

• CORS middleware in Pliny
• Wikipedia