The API fully supports [CORS](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing) for all API endpoints. This allows you to build client-side applications that you can host and run from within your own environment or from within something like an AWS S3 bucket.

#### What is CORS, and why do I care?

With JavaScript, a browser can interact with an API over HTTP. This technique, often referred to as Ajax, allows for powerful and flexible client-side applications and is used in a huge number of modern web sites and applications today. There's a reason for the shift towards client-side applications: They allow fast, responsive and "app-like" experiences, allow for rapid changes and additions to user interfaces and experiences, provide a clear separation between server-side and client-side portions of the application, and empower people who are "mostly designers" to get more deeply involved with the development and implementation of an application's user experience without having to dive into back-end code.

For security reasons, browsers do not allow Ajax requests to be made to servers that have a different origin than the one the page is served from. This is known the [Same Origin Policy](https://en.wikipedia.org/wiki/Same-origin_policy) and provides significant security benefits. So, if you have a web page running on your-domain.com and you wanted to make a call to an API located at other-domain.com, the browser would not allow the request and response to process successfully. [Read more about why the same origin policy is important](http://security.stackexchange.com/a/8269/41655).

#### CORS to the Rescue

As the web evolved, it became clear that there were a significant number of legitimate use cases for cross-origin Ajax requests. Turning off the same-origin policy would disable one of the fundamental security models of the web, so a new system was developed to allow cross-origin calls to be made securely: _cross origin resource sharing_ or CORS.

CORS allows a server to say "I will allow cross-origin resource requests, but only from these origins". This allows a web server to "opt in" to a cross origin request, and when doing so can make sure that the endpoints it exposes to cross-origin calls are prepared for the additional security requirements and can limit the origins from which requests can be made. CORS also allows a server to provide a "wildcard" response, which says "I will allow cross-origin requests from any origin".

#### CORS and the Comecero API

For security reasons described above, we only allow CORS requests for your account from origins that you explicitly permit. You can easily manage your origins through your account settings (under Settings> Technical) or through the API directly. Note that all origins you intend to use need to be listed or your requests to the API from the browser will not be successful. This includes origins that you use in local development. The origins you provide do not have to be valid in the real-world (for example, if you use not-a-real-domain.com in local development). However, any origin that you intend to use _must_ be listed or your requests will fail.

For convenience in development and testing, requests from `127.0.0.1` and `localhost` are always permitted even if not listed within your account.

It is important to note that while all modern browsers support cross-origin calls, [some older browsers do not](http://caniuse.com/#feat=cors). Depending on your audience, this may or may not be an issue. For internal applications (i.e. tools for internal employees or users) you can generally control or mandate that only modern browsers are used to access the application. This is not the case with external applications (such as shopping carts, checkout and customer management apps).

Additionally, many cross-origin calls are subject to a "pre-flight" request to confirm with the server that the origin is approved before the request is made. This adds a small measure of performance overhead as it increases the communication that must be done with the API when making requests.

To address this, Comecero provides a robust and high-performance hosting environment for client-side applications. When you host within this environment, calls to the API are automatically proxied and therefore not subject to cross-origin restrictions because the hostname of the API and application are the same. Additionally, the Comecero hosting environment is fully PCI-compliant, which means by hosting your applications within Comecero, you greatly reduce your PCI burdens. This hosting environment is provided at no additional cost to you and can support custom domains and SSL certificates. [Read more about hosting custom applications here](https://docs.comecero.com/docs/basic-concepts/cors#custom-applications).