A CORS error means a browser is refusing to expose a cross-origin response to your page. An API opening in a separate tab or working in a command-line client does not prove its browser-access policy is configured correctly.
Step-by-step solution
- Open developer tools and identify the failing request, the page’s origin, and any OPTIONS preflight request.
- If you are only visiting the website, report the error to its owner. Browser extensions that disable CORS are not a production solution.
- If you control the API, configure Access-Control-Allow-Origin for the exact approved origin, including its scheme and port where relevant.
- Ensure the preflight response allows the actual method and requested headers. Check whether authentication middleware or a redirect is preventing OPTIONS from succeeding.
- For credentialed requests, use an explicit approved origin and the appropriate credential policy; do not combine credentials with a wildcard origin.
- Retest from the real deployed frontend. If the API is third-party, use its supported integration or an authorized backend rather than trying to bypass browser enforcement.
How to check the fix
The browser can read the intended response and the Network panel shows a successful preflight when required.
Before you try other fixes
CORS is not a substitute for authentication or authorization. Avoid reflecting any incoming Origin without checking an allowlist.
