> Frontend candidates who have worked with CORS still aren't able to explain SOP and why those policies exist, in my experience
But that's exactly the kind of thing you want to surface in the hiring process with that question :) I guess it depends on if you're hiring juniors to be trained, or seniors to elevate your current team, but personally I'd skip very quickly on people who don't know the basics of their jobs, unless of course the point is to hire them to train them.
To be fair, I set up our CORS policy 6-7 years ago. I don’t remember the details anymore. I’ve been busy building product. So, this interview question will make me stumble, even though I’m quite senior. I think asking people about things that are set it and forget it once per project is probably not the best way to screen for relevant knowledge.
If understanding Origin isn't part of what a frontend developer needs know, kind of feels like nothing is. You need to understand that part to even know what APIs are available to you, without a "secure origin" you won't have access to cryptography, geolocation and a whole host of other JS APIs, as just one example. Understanding why HTTP requests works against one API but not the other also feels like pretty trivial troubleshooting skills.
I'm not saying people should make hiring decisions based on one question that people may not have in the forefront of their mind, but evaluating if a web backend developer understands HTTP or if a frontend developer understands Origins feels like pretty bare minimum here. If you don't recall 100% of the details, surely you must remember some, or if reminded, some details about it are remembered. Otherwise, maybe you actually have lost the expertise since then? That's a useful signal too.
But that's exactly the kind of thing you want to surface in the hiring process with that question :) I guess it depends on if you're hiring juniors to be trained, or seniors to elevate your current team, but personally I'd skip very quickly on people who don't know the basics of their jobs, unless of course the point is to hire them to train them.