CORS

CORS - Cross-Origin Resource Sharing - is the browser mechanism that governs whether JavaScript running on one website may send requests to a server on a different domain. By default, browsers restrict such cross-origin calls; CORS is the protocol by which a server declares which origins it is willing to hear from, using response headers like Access-Control-Allow-Origin.

The rule exists to protect users: without it, any page you visited could quietly make authenticated requests to other sites you are logged into. For certain requests the browser first sends a preflight - an OPTIONS request asking permission - and only proceeds with the real call if the server's headers approve the origin, method, and headers involved.

For form services, CORS doubles as an access-control tool. An endpoint that answers AJAX requests from anywhere will happily accept posts from sites that copied your endpoint URL. An origin allowlist narrows that: only JavaScript submissions from domains you named get through, and everything else is refused at the browser boundary.

SheetLink Forms gives each form a per-form origin allowlist backed by CORS. Add the domains your form legitimately lives on, and AJAX submissions from those origins are accepted while requests from unlisted origins are blocked with a 403. This is one layer of the spam and abuse stack, alongside rate limits, the honeypot, and content heuristics - it stops other sites from borrowing your endpoint token for their own traffic.

Plain HTML posts (a form action with a full-page submit) are not subject to CORS, which is why the allowlist is described as one layer rather than the whole defense. Configuration details are in the docs, and the layered model on the security page.