{"id":37105,"date":"2025-12-27T13:00:38","date_gmt":"2025-12-27T10:00:38","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/"},"modified":"2025-12-27T13:00:38","modified_gmt":"2025-12-27T10:00:38","slug":"bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/","title":{"rendered":"Bu CORS Hatas\u0131 API’nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum)"},"content":{"rendered":"

Bu CORS Hatas\u0131 API’nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum)<\/h2>\n

Web geli\u015ftirmenin derinliklerine indik\u00e7e, \u00e7o\u011fu zaman g\u00f6zden ka\u00e7an veya yanl\u0131\u015f anla\u015f\u0131lan kritik g\u00fcvenlik mekanizmalar\u0131yla kar\u015f\u0131la\u015f\u0131r\u0131z. Bunlardan biri de Cross-Origin Resource Sharing (CORS) politikas\u0131d\u0131r. CORS, modern web uygulamalar\u0131n\u0131n temel ta\u015flar\u0131ndan biri olmas\u0131na ra\u011fmen, yanl\u0131\u015f yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131nda API’lerinizi beklenmedik ve tehlikeli g\u00fcvenlik a\u00e7\u0131klar\u0131na maruz b\u0131rakabilir. \u00d6zellikle Access-Control-Allow-Origin: *<\/code> kullan\u0131m\u0131, masum gibi g\u00f6r\u00fcnse de, \u00e7o\u011fu durumda bir g\u00fcvenlik felaketine davetiye \u00e7\u0131kar\u0131r. Bu makalede, bu yayg\u0131n hatay\u0131, neden tehlikeli oldu\u011funu ve API’lerinizi g\u00fcvende tutmak i\u00e7in do\u011fru CORS yap\u0131land\u0131rmas\u0131n\u0131n nas\u0131l olmas\u0131 gerekti\u011fini detayl\u0131ca inceleyece\u011fiz.<\/p>\n

CORS Nedir ve Neden Hayati \u00d6nem Ta\u015f\u0131r?<\/h3>\n

Cross-Origin Resource Sharing (CORS), taray\u0131c\u0131lar\u0131n farkl\u0131 kaynaklardan (domain, protokol veya port) gelen kaynaklara eri\u015fimini kontrol eden bir g\u00fcvenlik mekanizmas\u0131d\u0131r. Temelinde, web’in g\u00fcvenlik modeli olan Same-Origin Policy (SOP) yatar. SOP, bir web sayfas\u0131n\u0131n, y\u00fcklendi\u011fi kaynak d\u0131\u015f\u0131ndaki bir kaynaktan veri okumas\u0131n\u0131 veya de\u011fi\u015ftirmesini engeller. Bu, k\u00f6t\u00fc niyetli sitelerin kullan\u0131c\u0131lar\u0131n bankac\u0131l\u0131k sitelerinden veya e-posta hesaplar\u0131ndan veri \u00e7almas\u0131n\u0131 \u00f6nlemek i\u00e7in tasarlanm\u0131\u015ft\u0131r.<\/p>\n

Same-Origin Policy (SOP) ve G\u00fcvenlik<\/h4>\n

SOP, bir belgenin veya script’in yaln\u0131zca ayn\u0131 kaynakla (protokol, ana bilgisayar ve ba\u011flant\u0131 noktas\u0131 kombinasyonu) etkile\u015fime girmesine izin verir. \u00d6rne\u011fin, https:\/\/example.com<\/code> adresindeki bir sayfa, https:\/\/api.example.com<\/code> adresindeki bir API’ye istek g\u00f6nderebilir, ancak https:\/\/malicious.com<\/code> adresindeki bir API’ye do\u011frudan veri okuma ama\u00e7l\u0131 istek g\u00f6nderemez. SOP, taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lar\u0131, \u00f6zellikle de siteler aras\u0131 komut dosyas\u0131 \u00e7al\u0131\u015ft\u0131rma (XSS) ve siteler aras\u0131 istek sahtecili\u011fi (CSRF) gibi sald\u0131r\u0131lar\u0131 \u00f6nlemede kritik bir rol oynar.<\/p>\n

CORS’un Do\u011fu\u015fu ve Amac\u0131<\/h4>\n

SOP, web g\u00fcvenli\u011fi i\u00e7in hayati olsa da, modern web uygulamalar\u0131 genellikle farkl\u0131 kaynaklardaki API’lerle veya kaynaklarla etkile\u015fim kurma ihtiyac\u0131 duyar. \u00d6rne\u011fin, app.example.com<\/code> adresindeki bir frontend uygulamas\u0131, api.example.com<\/code> adresindeki bir backend API’sine istek g\u00f6ndermek isteyebilir. SOP bunu engellerdi. \u0130\u015fte burada CORS devreye girer. CORS, sunucular\u0131n, farkl\u0131 kaynaklardan gelen isteklere izin vereceklerini a\u00e7\u0131k\u00e7a beyan etmelerini sa\u011flayan bir mekanizma sunar. Bu sayede, SOP’nin kat\u0131 kurallar\u0131, g\u00fcvenli bir \u015fekilde esnetilebilir.<\/p>\n

CORS Nas\u0131l \u00c7al\u0131\u015f\u0131r? Mekanizmay\u0131 Anlamak<\/h3>\n

CORS, temelde taray\u0131c\u0131 ve sunucu aras\u0131nda bir dizi ba\u015fl\u0131k de\u011fi\u015fimiyle \u00e7al\u0131\u015f\u0131r. Taray\u0131c\u0131, farkl\u0131 bir kaynaktan bir istek g\u00f6nderdi\u011finde, bu iste\u011fin CORS kurallar\u0131na uygun olup olmad\u0131\u011f\u0131n\u0131 kontrol eder. \u0130ki ana istek t\u00fcr\u00fc vard\u0131r: basit istekler ve \u00f6n kontrol (preflight) istekleri.<\/p>\n

Basit \u0130stekler (Simple Requests)<\/h4>\n

Belirli ko\u015fullar\u0131 kar\u015f\u0131layan istekler “basit istekler” olarak kabul edilir. Bu ko\u015fullar \u015funlard\u0131r:<\/p>\n

    \n
  • Metot: GET<\/code>, HEAD<\/code> veya POST<\/code> olmal\u0131.<\/li>\n
  • Ba\u015fl\u0131klar: Yaln\u0131zca CORS g\u00fcvenli listesindeki ba\u015fl\u0131klar (\u00f6rn. Accept<\/code>, Accept-Language<\/code>, Content-Language<\/code>, Content-Type<\/code>). Content-Type<\/code> i\u00e7in sadece application\/x-www-form-urlencoded<\/code>, multipart\/form-data<\/code> veya text\/plain<\/code> izinlidir.<\/li>\n<\/ul>\n

    Basit bir istekte, taray\u0131c\u0131 iste\u011fi do\u011frudan g\u00f6nderir ve sunucudan gelen yan\u0131tta Access-Control-Allow-Origin<\/code> ba\u015fl\u0131\u011f\u0131n\u0131 arar. E\u011fer bu ba\u015fl\u0131k, iste\u011fi g\u00f6nderen kayna\u011f\u0131 i\u00e7eriyorsa veya wildcard (*<\/code>) ise, taray\u0131c\u0131 yan\u0131ta eri\u015fime izin verir. Aksi takdirde, taray\u0131c\u0131 iste\u011fi engeller ve bir CORS hatas\u0131 f\u0131rlat\u0131r.<\/p>\n

    \u00d6n Kontrol (Preflight) \u0130stekleri<\/h4>\n

    Basit istek ko\u015fullar\u0131n\u0131 kar\u015f\u0131lamayan t\u00fcm di\u011fer istekler (\u00f6rn. PUT<\/code>, DELETE<\/code> metotlar\u0131, \u00f6zel ba\u015fl\u0131klar veya farkl\u0131 Content-Type<\/code> de\u011ferleri i\u00e7eren istekler) bir “\u00f6n kontrol” (preflight) iste\u011fi ile ba\u015flar. Bu, as\u0131l iste\u011fi g\u00f6ndermeden \u00f6nce taray\u0131c\u0131n\u0131n sunucuya bir OPTIONS<\/code> iste\u011fi g\u00f6ndermesi anlam\u0131na gelir. Bu OPTIONS<\/code> iste\u011fi, sunucunun as\u0131l iste\u011fi kabul edip etmeyece\u011fini sorgular.<\/p>\n

    \u00d6n kontrol iste\u011fi, a\u015fa\u011f\u0131daki ba\u015fl\u0131klar\u0131 i\u00e7erir:<\/p>\n

      \n
    • Access-Control-Request-Method<\/code>: As\u0131l iste\u011fin metodunu belirtir (\u00f6rn. PUT<\/code>).<\/li>\n
    • Access-Control-Request-Headers<\/code>: As\u0131l iste\u011fin i\u00e7erece\u011fi \u00f6zel ba\u015fl\u0131klar\u0131 belirtir.<\/li>\n
    • Origin<\/code>: \u0130ste\u011fi g\u00f6nderen kayna\u011f\u0131 belirtir.<\/li>\n<\/ul>\n

      Sunucu, bu OPTIONS<\/code> iste\u011fine, as\u0131l iste\u011fin kabul edilebilir olup olmad\u0131\u011f\u0131n\u0131 belirten ba\u015fl\u0131klarla yan\u0131t verir:<\/p>\n

        \n
      • Access-Control-Allow-Origin<\/code>: Hangi kaynaklar\u0131n isteklere izinli oldu\u011funu.<\/li>\n
      • Access-Control-Allow-Methods<\/code>: Hangi HTTP metotlar\u0131n\u0131n izinli oldu\u011funu.<\/li>\n
      • Access-Control-Allow-Headers<\/code>: Hangi \u00f6zel ba\u015fl\u0131klar\u0131n izinli oldu\u011funu.<\/li>\n
      • Access-Control-Max-Age<\/code>: \u00d6n kontrol yan\u0131t\u0131n\u0131n ne kadar s\u00fcreyle \u00f6nbelle\u011fe al\u0131nabilece\u011fini.<\/li>\n<\/ul>\n

        E\u011fer sunucunun yan\u0131t\u0131, as\u0131l iste\u011fin gereksinimlerini kar\u015f\u0131l\u0131yorsa, taray\u0131c\u0131 as\u0131l iste\u011fi g\u00f6nderir. Aksi takdirde, yine bir CORS hatas\u0131 f\u0131rlat\u0131l\u0131r.<\/p>\n

        Yayg\u0131n ve Tehlikeli CORS Yap\u0131land\u0131rma Hatas\u0131: Access-Control-Allow-Origin: *<\/code><\/h3>\n

        En s\u0131k kar\u015f\u0131la\u015f\u0131lan ve en tehlikeli CORS yap\u0131land\u0131rma hatalar\u0131ndan biri, sunucunun Access-Control-Allow-Origin<\/code> ba\u015fl\u0131\u011f\u0131n\u0131 *<\/code> (wildcard) olarak ayarlamas\u0131d\u0131r. Bu, “herhangi bir kayna\u011f\u0131n bu API’ye eri\u015fmesine izin ver” anlam\u0131na gelir ve ilk bak\u0131\u015fta esneklik sa\u011flad\u0131\u011f\u0131 d\u00fc\u015f\u00fcn\u00fclebilir. Ancak, \u00e7o\u011fu durumda bu, API’nizi ciddi g\u00fcvenlik risklerine a\u00e7\u0131k hale getirir.<\/p>\n

        Wildcard Kullan\u0131m\u0131n\u0131n Cazibesi ve Yan\u0131lg\u0131s\u0131<\/h4>\n

        Geli\u015ftiriciler, \u00f6zellikle geli\u015ftirme a\u015famas\u0131nda veya CORS hatalar\u0131ndan ka\u00e7\u0131nmak i\u00e7in h\u0131zl\u0131 bir \u00e7\u00f6z\u00fcm aray\u0131\u015f\u0131nda olduklar\u0131nda Access-Control-Allow-Origin: *<\/code> kullanmaya y\u00f6nelebilirler. Bu, t\u00fcm CORS hatalar\u0131n\u0131 ortadan kald\u0131r\u0131r ve API’nin her yerden eri\u015filebilir olmas\u0131n\u0131 sa\u011flar. Ancak bu kolayl\u0131k, genellikle b\u00fcy\u00fck bir g\u00fcvenlik maliyetiyle gelir.<\/p>\n

        null<\/code> Origin ve Di\u011fer Beklenmedik Davran\u0131\u015flar<\/h4>\n

        *<\/code> kullan\u0131m\u0131 sadece bilinen domainler i\u00e7in de\u011fil, ayn\u0131 zamanda file:\/\/<\/code> protokol\u00fcyle \u00e7al\u0131\u015fan yerel dosyalar veya sandboxed iframe’ler gibi “null” origin’e sahip kaynaklar i\u00e7in de eri\u015fime izin verir. Bu, sald\u0131rganlar\u0131n yerel dosyalar arac\u0131l\u0131\u011f\u0131yla veya belirli iframe senaryolar\u0131nda API’nize eri\u015febilece\u011fi beklenmedik vekt\u00f6rler yaratabilir.<\/p>\n

        Bu Hata Neden Bir G\u00fcvenlik A\u00e7\u0131\u011f\u0131d\u0131r?<\/h3>\n

        Access-Control-Allow-Origin: *<\/code> tek ba\u015f\u0131na her zaman bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 de\u011fildir. Ancak, API’niz kimlik bilgileri (\u00e7erezler, HTTP kimlik do\u011frulama ba\u015fl\u0131klar\u0131, istemci sertifikalar\u0131 vb.) ile \u00e7al\u0131\u015fan istekleri destekliyorsa, bu yap\u0131land\u0131rma kritik bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131na d\u00f6n\u00fc\u015f\u00fcr.<\/p>\n

        Kimlik Bilgileriyle \u0130stekler (credentials<\/code>) ve Tehlike<\/h4>\n

        Bir taray\u0131c\u0131, farkl\u0131 bir kaynaktan bir iste\u011fi kimlik bilgileriyle (\u00f6rn. \u00e7erezler) g\u00f6ndermek istedi\u011finde, iste\u011fe credentials: 'include'<\/code> veya withCredentials = true<\/code> bayra\u011f\u0131n\u0131 ekler. Bu durumda, sunucunun yan\u0131t\u0131nda Access-Control-Allow-Credentials: true<\/code> ba\u015fl\u0131\u011f\u0131n\u0131n da bulunmas\u0131 gerekir. Ancak, taray\u0131c\u0131lar, Access-Control-Allow-Origin<\/code> ba\u015fl\u0131\u011f\u0131 *<\/code> olarak ayarland\u0131\u011f\u0131nda ve Access-Control-Allow-Credentials: true<\/code> de varsa, bu iste\u011fi reddederler.<\/strong><\/p>\n

        Bu, bir g\u00fcvenlik mekanizmas\u0131d\u0131r. E\u011fer sunucu hem *<\/code> hem de true<\/code> de\u011ferlerine izin verseydi, k\u00f6t\u00fc niyetli bir web sitesi, kullan\u0131c\u0131n\u0131n taray\u0131c\u0131s\u0131nda oturum a\u00e7m\u0131\u015f oldu\u011fu bir API’ye kendi \u00e7erezleriyle istek g\u00f6nderebilir ve hassas verilere eri\u015febilirdi. Ancak, baz\u0131 sunucu taraf\u0131 k\u00fct\u00fcphaneleri veya proxy yap\u0131land\u0131rmalar\u0131, bu kural\u0131 atlayarak her ikisine de izin verecek \u015fekilde yanl\u0131\u015f yap\u0131land\u0131r\u0131labilir. Bu durumda, sald\u0131rganlar i\u00e7in kap\u0131lar ard\u0131na kadar a\u00e7\u0131l\u0131r.<\/p>\n

        CSRF (Cross-Site Request Forgery) Senaryolar\u0131<\/h4>\n

        Yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f CORS, \u00f6zellikle Access-Control-Allow-Origin: *<\/code> ve kimlik bilgileriyle \u00e7al\u0131\u015fan API’ler, CSRF sald\u0131r\u0131lar\u0131na zemin haz\u0131rlayabilir. Bir sald\u0131rgan, kullan\u0131c\u0131y\u0131 kendi k\u00f6t\u00fc niyetli web sitesine (malicious.com<\/code>) \u00e7ekebilir. Bu sitede, kullan\u0131c\u0131n\u0131n oturum a\u00e7m\u0131\u015f oldu\u011fu API’ye (api.example.com<\/code>) bir istek g\u00f6nderen bir JavaScript kodu \u00e7al\u0131\u015ft\u0131rabilirler. E\u011fer API, *<\/code>‘dan gelen isteklere kimlik bilgileriyle eri\u015fime izin veriyorsa, sald\u0131rgan kullan\u0131c\u0131n\u0131n ad\u0131na hassas i\u015flemler yapabilir (\u00f6rn. \u015fifre de\u011fi\u015ftirme, para transferi). Taray\u0131c\u0131, normalde bu iste\u011fi Same-Origin Policy nedeniyle engellerdi, ancak yanl\u0131\u015f CORS yap\u0131land\u0131rmas\u0131 bu engeli kald\u0131r\u0131r.<\/p>\n

        \n

        K\u00f6t\u00fc Niyetli Bir Sayfadan API Eri\u015fimi Senaryosu:<\/strong><\/p>\n

        \n\/\/ malicious.com adresindeki bir sayfa\nfetch('https:\/\/api.example.com\/user\/profile', {\n    method: 'GET',\n    credentials: 'include' \/\/ Kullan\u0131c\u0131n\u0131n \u00e7erezlerini g\u00f6nder\n})\n.then(response => response.json())\n.then(data => {\n    console.log('Kullan\u0131c\u0131 verileri \u00e7al\u0131nd\u0131:', data);\n    \/\/ Verileri kendi sunucumuza g\u00f6nder\n})\n.catch(error => {\n    console.error('Hata:', error);\n});\n    <\/pre>\n
        <\/code><\/p>\n
        E\u011fer api.example.com<\/code>, Access-Control-Allow-Origin: *<\/code> ve Access-Control-Allow-Credentials: true<\/code> ba\u015fl\u0131klar\u0131n\u0131 ayn\u0131 anda d\u00f6nd\u00fcrecek \u015fekilde yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015fsa, bu kod kullan\u0131c\u0131n\u0131n hassas verilerine eri\u015febilir.<\/p>\n<\/div>\n
        Do\u011fru CORS Yap\u0131land\u0131rmas\u0131 Nas\u0131l Olmal\u0131?<\/h3>\n
        API'nizi g\u00fcvende tutmak i\u00e7in do\u011fru CORS yap\u0131land\u0131rmas\u0131, her zaman m\u00fcmk\u00fcn olan en k\u0131s\u0131tl\u0131 eri\u015fimi sa\u011flamak \u00fczerine kuruludur. \u0130\u015fte do\u011fru yakla\u015f\u0131mlar:<\/p>\n
        Belirli Originlere \u0130zin Verme<\/h4>\n
        API'nize eri\u015fmesi gereken belirli kaynaklar\u0131 a\u00e7\u0131k\u00e7a belirtin. Asla *<\/code> kullanmay\u0131n, \u00f6zellikle de kimlik bilgileriyle \u00e7al\u0131\u015f\u0131yorsan\u0131z. Birden fazla kayna\u011fa izin vermeniz gerekiyorsa, sunucu taraf\u0131nda gelen Origin<\/code> ba\u015fl\u0131\u011f\u0131n\u0131 kontrol edin ve yaln\u0131zca izin verilen kaynaklardan biriyle e\u015fle\u015fiyorsa o kayna\u011f\u0131 Access-Control-Allow-Origin<\/code> ba\u015fl\u0131\u011f\u0131na yazd\u0131r\u0131n.<\/p>\n
        \n
        Do\u011fru CORS Yap\u0131land\u0131rma \u00d6rne\u011fi (Node.js\/Express):<\/strong><\/p>\n
        \nconst express = require('express');\nconst app = express();\n\nconst allowedOrigins = ['https:\/\/app.example.com', 'https:\/\/admin.example.com'];\n\napp.use((req, res, next) => {\n    const origin = req.headers.origin;\n    if (allowedOrigins.includes(origin)) {\n        res.setHeader('Access-Control-Allow-Origin', origin);\n    }\n    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');\n    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');\n    res.setHeader('Access-Control-Allow-Credentials', 'true'); \/\/ E\u011fer kimlik bilgileri kullan\u0131l\u0131yorsa\n    \n    \/\/ \u00d6n kontrol isteklerini yan\u0131tla\n    if (req.method === 'OPTIONS') {\n        return res.sendStatus(200);\n    }\n    next();\n});\n\n\/\/ API rotalar\u0131n\u0131z burada\napp.get('\/data', (req, res) => {\n    res.json({ message: 'G\u00fcvenli veri!' });\n});\n\napp.listen(3000, () => {\n    console.log('API dinlemede...');\n});\n    <\/pre>\n
        <\/code>\n<\/div>\n
        Access-Control-Allow-Credentials<\/code> Kullan\u0131m\u0131<\/h4>\n
        E\u011fer API'niz \u00e7erezler veya HTTP kimlik do\u011frulama gibi kimlik bilgileriyle \u00e7al\u0131\u015f\u0131yorsa, Access-Control-Allow-Credentials: true<\/code> ba\u015fl\u0131\u011f\u0131n\u0131 ayarlaman\u0131z gerekir. Ancak unutmay\u0131n, bu ba\u015fl\u0131k varsa, Access-Control-Allow-Origin<\/code> ba\u015fl\u0131\u011f\u0131 asla *<\/code> olamaz; belirli bir kaynak belirtilmelidir.<\/p>\n
        Di\u011fer \u00d6nemli CORS Ba\u015fl\u0131klar\u0131<\/h4>\n
          \n
        • Access-Control-Allow-Methods<\/code>: API'nizin hangi HTTP metotlar\u0131n\u0131 kabul etti\u011fini a\u00e7\u0131k\u00e7a belirtin (\u00f6rn. GET, POST, PUT, DELETE<\/code>).<\/li>\n
        • Access-Control-Allow-Headers<\/code>: \u0130stemcilerin g\u00f6ndermesine izin verilen \u00f6zel HTTP ba\u015fl\u0131klar\u0131n\u0131 belirtin (\u00f6rn. Content-Type, Authorization<\/code>).<\/li>\n
        • Access-Control-Max-Age<\/code>: \u00d6n kontrol (preflight) yan\u0131t\u0131n\u0131n ne kadar s\u00fcreyle \u00f6nbelle\u011fe al\u0131nabilece\u011fini belirtir. Bu, gereksiz OPTIONS<\/code> isteklerini azaltarak performans\u0131 art\u0131rabilir.<\/li>\n<\/ul>\n
          CORS Hatalar\u0131n\u0131 Ay\u0131klama ve \u00c7\u00f6zme<\/h3>\n
          CORS hatalar\u0131, geli\u015ftiricilerin en \u00e7ok kar\u015f\u0131la\u015ft\u0131\u011f\u0131 ve bazen de en kafa kar\u0131\u015ft\u0131r\u0131c\u0131 hatalardan biridir. \u0130\u015fte bu hatalar\u0131 ay\u0131klamak ve \u00e7\u00f6zmek i\u00e7in baz\u0131 ipu\u00e7lar\u0131:<\/p>\n
          Taray\u0131c\u0131 Geli\u015ftirici Ara\u00e7lar\u0131<\/h4>\n
          Taray\u0131c\u0131n\u0131z\u0131n geli\u015ftirici ara\u00e7lar\u0131 (Console ve Network sekmeleri), CORS hatalar\u0131n\u0131 te\u015fhis etmek i\u00e7in en iyi ara\u00e7lard\u0131r. Konsolda genellikle hatan\u0131n nedenini a\u00e7\u0131klayan net mesajlar bulursunuz (\u00f6rn. \"has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present\"). Network sekmesinde ise, iste\u011fin ba\u015fl\u0131klar\u0131n\u0131 (request headers) ve sunucudan gelen yan\u0131t ba\u015fl\u0131klar\u0131n\u0131 (response headers) inceleyerek sorunun kayna\u011f\u0131n\u0131 bulabilirsiniz.<\/p>\n
          Sunucu Loglar\u0131 ve Konfig\u00fcrasyon Dosyalar\u0131<\/h4>\n
          API sunucunuzun loglar\u0131n\u0131 kontrol edin. Gelen isteklerin Origin<\/code> ba\u015fl\u0131klar\u0131n\u0131 ve sunucunuzun CORS ba\u015fl\u0131klar\u0131n\u0131 nas\u0131l ayarlad\u0131\u011f\u0131n\u0131 g\u00f6steren bilgileri aray\u0131n. Web sunucunuzun (Nginx, Apache) veya uygulama \u00e7er\u00e7evesinizin (Express, Flask, Spring Boot) CORS konfig\u00fcrasyonunu dikkatlice g\u00f6zden ge\u00e7irin.<\/p>\n
          curl<\/code> ile Test Etme<\/h4>\n
          curl<\/code> komut sat\u0131r\u0131 arac\u0131, CORS yap\u0131land\u0131rman\u0131z\u0131 test etmek i\u00e7in \u00e7ok kullan\u0131\u015fl\u0131d\u0131r. Belirli bir Origin<\/code> ba\u015fl\u0131\u011f\u0131yla bir istek g\u00f6ndererek sunucunuzun nas\u0131l yan\u0131t verdi\u011fini g\u00f6rebilirsiniz:<\/p>\n
          \n
          \ncurl -v -H \"Origin: https:\/\/app.example.com\" https:\/\/api.example.com\/data\n    <\/pre>\n
          <\/code><\/p>\n
          Bu komut, sunucudan gelen yan\u0131t ba\u015fl\u0131klar\u0131n\u0131 detayl\u0131 bir \u015fekilde g\u00f6sterir ve Access-Control-Allow-Origin<\/code> gibi CORS ba\u015fl\u0131klar\u0131n\u0131n do\u011fru ayarlan\u0131p ayarlanmad\u0131\u011f\u0131n\u0131 kontrol etmenizi sa\u011flar.<\/p>\n<\/div>\n
          API G\u00fcvenli\u011fi \u0130\u00e7in Ek \u0130pu\u00e7lar\u0131<\/h3>\n
          CORS, API g\u00fcvenli\u011finin sadece bir y\u00f6n\u00fcd\u00fcr. Kapsaml\u0131 bir g\u00fcvenlik stratejisi i\u00e7in ek \u00f6nlemler alman\u0131z \u00f6nemlidir:<\/p>\n
          Kimlik Do\u011frulama ve Yetkilendirme<\/h4>\n
          T\u00fcm API u\u00e7 noktalar\u0131n\u0131za uygun kimlik do\u011frulama (Authentication) ve yetkilendirme (Authorization) mekanizmalar\u0131 uygulay\u0131n. JWT (JSON Web Tokens), OAuth 2.0 veya API anahtarlar\u0131 gibi standartlar\u0131 kullan\u0131n. Her iste\u011fin kimli\u011fini do\u011frulay\u0131n ve kullan\u0131c\u0131n\u0131n istenen eylemi ger\u00e7ekle\u015ftirme yetkisine sahip olup olmad\u0131\u011f\u0131n\u0131 kontrol edin.<\/p>\n
          Giri\u015f Do\u011frulama ve \u00c7\u0131k\u0131\u015f Temizleme<\/h4>\n
          API'nize gelen t\u00fcm giri\u015fleri (input) dikkatlice do\u011frulay\u0131n ve temizleyin. SQL enjeksiyonu, XSS ve komut enjeksiyonu gibi sald\u0131r\u0131lar\u0131 \u00f6nlemek i\u00e7in kullan\u0131c\u0131 taraf\u0131ndan sa\u011flanan verileri asla do\u011frudan kullanmay\u0131n. Yan\u0131tlardan g\u00f6nderdi\u011finiz verileri de temizleyerek bilgi s\u0131z\u0131nt\u0131lar\u0131n\u0131 \u00f6nleyin.<\/p>\n
          Rate Limiting (H\u0131z S\u0131n\u0131rland\u0131rma)<\/h4>\n
          API'nizin k\u00f6t\u00fcye kullan\u0131m\u0131n\u0131 veya DoS (Denial of Service) sald\u0131r\u0131lar\u0131n\u0131 \u00f6nlemek i\u00e7in h\u0131z s\u0131n\u0131rlamas\u0131 uygulay\u0131n. Belirli bir zaman diliminde bir kullan\u0131c\u0131n\u0131n veya IP adresinin yapabilece\u011fi istek say\u0131s\u0131n\u0131 s\u0131n\u0131rlay\u0131n.<\/p>\n
          G\u00fcvenlik Ba\u015fl\u0131klar\u0131<\/h4>\n
          API yan\u0131tlar\u0131n\u0131za ek g\u00fcvenlik ba\u015fl\u0131klar\u0131 ekleyin (\u00f6rn. X-Content-Type-Options: nosniff<\/code>, X-Frame-Options: DENY<\/code>, Content-Security-Policy<\/code>). Bu ba\u015fl\u0131klar, taray\u0131c\u0131lar\u0131n belirli g\u00fcvenlik \u00f6zelliklerini etkinle\u015ftirmesine yard\u0131mc\u0131 olur.<\/p>\n
          Sonu\u00e7<\/h3>\n
          CORS, modern web uygulamalar\u0131n\u0131n vazge\u00e7ilmez bir g\u00fcvenlik mekanizmas\u0131d\u0131r, ancak yanl\u0131\u015f yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131nda ciddi g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. \u00d6zellikle Access-Control-Allow-Origin: *<\/code> kullan\u0131m\u0131, kimlik bilgileriyle \u00e7al\u0131\u015fan API'ler i\u00e7in b\u00fcy\u00fck bir risktir ve API'nizi CSRF sald\u0131r\u0131lar\u0131na ve hassas veri s\u0131z\u0131nt\u0131lar\u0131na kar\u015f\u0131 savunmas\u0131z b\u0131rakabilir. Geli\u015ftiriciler olarak, CORS'un nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 anlamak, belirli kaynaklara izin vermek ve g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 do\u011fru bir \u015fekilde uygulamak, API'lerimizi ve kullan\u0131c\u0131lar\u0131m\u0131z\u0131n verilerini g\u00fcvende tutmak i\u00e7in hayati \u00f6neme sahiptir. Unutmay\u0131n, g\u00fcvenlikte \"kolay yol\", genellikle en tehlikeli yoldur. Her zaman en k\u0131s\u0131tl\u0131 ve en g\u00fcvenli yap\u0131land\u0131rmay\u0131 tercih edin.<\/p>\n
          SSS (S\u0131k Sorulan Sorular)<\/h3>\n
          CORS hatas\u0131 nedir?<\/h4>\n
          CORS hatas\u0131, bir web sayfas\u0131n\u0131n, y\u00fcklendi\u011fi kaynak d\u0131\u015f\u0131ndaki bir kaynaktan (farkl\u0131 bir domain, protokol veya port) veri talep etti\u011finde ve sunucunun bu iste\u011fe izin veren CORS ba\u015fl\u0131klar\u0131n\u0131 (\u00f6zellikle Access-Control-Allow-Origin<\/code>) g\u00f6ndermemesi durumunda taray\u0131c\u0131 taraf\u0131ndan ortaya \u00e7\u0131kar\u0131lan bir g\u00fcvenlik hatas\u0131d\u0131r. Taray\u0131c\u0131, Same-Origin Policy (SOP) nedeniyle bu iste\u011fi engeller.<\/p>\n
          Access-Control-Allow-Origin: *<\/code> kullanmak her zaman k\u00f6t\u00fc m\u00fc?<\/h4>\n
          Hay\u0131r, her zaman k\u00f6t\u00fc de\u011fildir. E\u011fer API'niz tamamen herkese a\u00e7\u0131k (public) ise, hi\u00e7bir hassas veri i\u00e7ermiyorsa ve kimlik bilgileri (\u00e7erezler, HTTP kimlik do\u011frulama) ile \u00e7al\u0131\u015fan istekleri kabul etmiyorsa, *<\/code> kullanmak sorun te\u015fkil etmeyebilir. Ancak, \u00e7o\u011fu API bir \u015fekilde hassas verilerle veya kimlik bilgileriyle \u00e7al\u0131\u015ft\u0131\u011f\u0131 i\u00e7in, bu genellikle k\u00f6t\u00fc bir uygulamad\u0131r ve g\u00fcvenlik riski ta\u015f\u0131r. G\u00fcvenlik a\u00e7\u0131s\u0131ndan en iyi uygulama, her zaman belirli kaynaklara izin vermektir.<\/p>\n
          CORS'u tamamen devre d\u0131\u015f\u0131 b\u0131rakmak g\u00fcvenli midir?<\/h4>\n
          Hay\u0131r, kesinlikle g\u00fcvenli de\u011fildir. CORS, taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lar\u0131 (\u00f6zellikle CSRF) \u00f6nlemek i\u00e7in tasarlanm\u0131\u015f kritik bir g\u00fcvenlik mekanizmas\u0131d\u0131r. CORS'u devre d\u0131\u015f\u0131 b\u0131rakmak, web uygulaman\u0131z\u0131 ve kullan\u0131c\u0131lar\u0131n\u0131z\u0131 ciddi g\u00fcvenlik risklerine maruz b\u0131rak\u0131r. Sunucu taraf\u0131nda CORS ba\u015fl\u0131klar\u0131n\u0131 do\u011fru yap\u0131land\u0131rmak, g\u00fcvenli ve i\u015flevsel bir \u00e7\u00f6z\u00fcm sunar.<\/p>\n
          Birden fazla origin'e izin vermek m\u00fcmk\u00fcn m\u00fcd\u00fcr?<\/h4>\n
          Evet, m\u00fcmk\u00fcnd\u00fcr. Ancak, Access-Control-Allow-Origin<\/code> ba\u015fl\u0131\u011f\u0131 birden fazla de\u011feri virg\u00fclle ayr\u0131lm\u0131\u015f bir liste olarak kabul etmez. Sunucunuzun, gelen iste\u011fin Origin<\/code> ba\u015fl\u0131\u011f\u0131n\u0131 kontrol etmesi ve bu ba\u015fl\u0131\u011f\u0131n izin verilen kaynaklar listenizde olup olmad\u0131\u011f\u0131n\u0131 do\u011frulamas\u0131 gerekir. E\u011fer e\u015fle\u015fiyorsa, sunucu yan\u0131t olarak o belirli Origin<\/code> de\u011ferini Access-Control-Allow-Origin<\/code> ba\u015fl\u0131\u011f\u0131na yazmal\u0131d\u0131r.<\/p>\n
          CORS hatalar\u0131n\u0131 nas\u0131l tespit ederim?<\/h4>\n
          CORS hatalar\u0131n\u0131 tespit etmenin en yayg\u0131n yolu, web taray\u0131c\u0131n\u0131z\u0131n geli\u015ftirici ara\u00e7lar\u0131n\u0131 kullanmakt\u0131r. Konsol sekmesinde genellikle hatan\u0131n nedenini a\u00e7\u0131klayan a\u00e7\u0131k mesajlar g\u00f6r\u00fcrs\u00fcn\u00fcz. A\u011f (Network) sekmesinde ise, ba\u015far\u0131s\u0131z olan iste\u011fi se\u00e7erek istek ve yan\u0131t ba\u015fl\u0131klar\u0131n\u0131 inceleyebilir, sunucudan beklenen CORS ba\u015fl\u0131klar\u0131n\u0131n gelip gelmedi\u011fini kontrol edebilirsiniz. Ayr\u0131ca, curl<\/code> gibi komut sat\u0131r\u0131 ara\u00e7lar\u0131yla belirli Origin<\/code> ba\u015fl\u0131klar\u0131yla test istekleri g\u00f6ndererek sunucunuzun CORS yan\u0131tlar\u0131n\u0131 do\u011frulayabilirsiniz.<\/p>\n","protected":false},"excerpt":{"rendered":"Cross-Origin Resource Sharing (CORS), taray\u0131c\u0131lar\u0131n farkl\u0131 kaynaklardan (domain, protokol veya port) gelen kaynaklara eri\u015fimini kontrol eden bir g\u00fcvenl…","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-37105","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nBu CORS Hatas\u0131 API'nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum) - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bu CORS Hatas\u0131 API'nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum)\" \/>\n<meta property=\"og:description\" content=\"Cross-Origin Resource Sharing (CORS), taray\u0131c\u0131lar\u0131n farkl\u0131 kaynaklardan (domain, protokol veya port) gelen kaynaklara eri\u015fimini kontrol eden bir g\u00fcvenl...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-27T10:00:38+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"14 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Bu CORS Hatas\u0131 API’nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum)\",\"datePublished\":\"2025-12-27T10:00:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/\"},\"wordCount\":2601,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/\",\"name\":\"Bu CORS Hatas\u0131 API'nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum) - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-12-27T10:00:38+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Bu CORS Hatas\u0131 API’nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Bu CORS Hatas\u0131 API'nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum) - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/","og_locale":"tr_TR","og_type":"article","og_title":"Bu CORS Hatas\u0131 API'nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum)","og_description":"Cross-Origin Resource Sharing (CORS), taray\u0131c\u0131lar\u0131n farkl\u0131 kaynaklardan (domain, protokol veya port) gelen kaynaklara eri\u015fimini kontrol eden bir g\u00fcvenl...","og_url":"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-12-27T10:00:38+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"14 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Bu CORS Hatas\u0131 API’nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum)","datePublished":"2025-12-27T10:00:38+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/"},"wordCount":2601,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/","url":"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/","name":"Bu CORS Hatas\u0131 API'nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum) - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-12-27T10:00:38+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/bu-cors-hatasi-apinizi-ortaya-cikariyor-her-yerde-goruyorum\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Bu CORS Hatas\u0131 API’nizi Ortaya \u00c7\u0131kar\u0131yor (Her Yerde G\u00f6r\u00fcyorum)"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37105","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=37105"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37105\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=37105"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=37105"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=37105"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}