Same Origin API routes

[jca41]

Bug report

Documentation states that

API Routes do not specify CORS headers, meaning they are same-origin only by default.

https://nextjs.org/docs/api-routes/introduction#caveats

Unless my understanding isn't correct, i shouldn't be able to Postman or https://reqbin.com/ my deployed API routes.

To Reproduce

1. Go to https://reqbin.com/
2. Make a request to a deployed API route

Expected behavior

I should see a CORS error.

Additional context

My app is deployed to Vercel.

[timneutkens]

CORS is a client-implemented protocol (e.g. Browsers). It does not block HTTP requests if you use curl / postman etc because those do not implement CORS.

[jca41]

Understood @timneutkens!

[balazsorban44]

This issue has been automatically locked due to no recent activity. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.