CORS errors happen when a browser blocks a cross-origin request because the server’s response does not permit the requesting origin or method. The problem is usually in HTTP response headers, not in the browser itself.
Use the CORS Header Checker to review the headers returned by a public endpoint.
What CORS controls
Cross-Origin Resource Sharing defines when browser-based JavaScript from one origin may read a response from another origin. Servers communicate these permissions with headers such as Access-Control-Allow-Origin.
How to troubleshoot a CORS error
- Confirm the exact requesting origin.
- Check the endpoint with the CORS Header Checker.
- Review the allowed origin, methods and headers.
- Check whether credentials such as cookies are involved.
- Test the browser request again after the server configuration changes.
Common mistakes
- Allowing the wrong origin.
- Forgetting to allow the request method used by the browser.
- Not handling preflight OPTIONS requests.
- Using a wildcard origin together with credentialed requests where it is not permitted.
- Changing frontend code when the real issue is the server response.
Do not make CORS broader than necessary
A quick fix such as allowing every origin can create unwanted exposure. Permit only the origins, methods and headers your application actually needs.
For a broader security review, also check response headers with the Security Headers Checker.
Remember what CORS is not
CORS is a browser access-control mechanism. It is not authentication and it does not prevent non-browser clients from contacting a public endpoint. Sensitive APIs still need proper authentication and authorization.
Inspect a public endpoint with the UptimeFixer CORS Header Checker.