Fix Cross-Origin Resource Sharing (CORS) errors
CORS errors occur when your frontend makes requests to a different origin (domain, port, or protocol) and the server doesn't include the correct Access-Control-Allow-Origin headers. The browser blocks the response to protect users.
Error messages you might see
Access to fetch at 'https://api.example.com' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.CORS policy: Response to preflight request doesn't pass access control check: The 'Access-Control-Allow-Origin' header has a value that is not equal to the supplied origin.Why this happens in AI-generated code
API server not configured for cross-origin requests
AI-generated backend code often doesn't include CORS middleware or headers, because the AI tested with same-origin requests or server-side calls where CORS doesn't apply.
Preflight OPTIONS request not handled
AI tools generate API endpoints that handle POST/PUT but miss the OPTIONS method. Browsers send a preflight OPTIONS request for non-simple requests, and without a response, the actual request is blocked.
Credentials mode mismatch
AI-generated code includes credentials: 'include' in fetch but the server responds with Access-Control-Allow-Origin: * which is incompatible — credentials require a specific origin.
How to fix it
Configure CORS headers on your API
Add Access-Control-Allow-Origin with your frontend's origin, handle OPTIONS preflight requests, and include Access-Control-Allow-Methods and Access-Control-Allow-Headers.
Use Next.js API routes as a proxy
Instead of calling external APIs directly from the browser, proxy requests through Next.js API routes (same origin) to avoid CORS entirely.
Get professional help
Still stuck? Our engineers can configure CORS correctly across your stack. Visit /products to get started.
Related technologies
Can't fix it yourself?
Our code audit identifies this issue and dozens more. Get a prioritized fix list.
Security Scan
Black-box review of your public-facing app. No code access needed.
- OWASP Top 10 checks
- SSL/TLS analysis
- Security headers
- Expert review within 24h
Code Audit
In-depth review of your source code for security, quality, and best practices.
- Security vulnerabilities
- Code quality review
- Dependency audit
- AI pattern analysis
Complete Bundle
Both scans in one package with cross-referenced findings.
- Everything in both products
- Cross-referenced findings
- Unified action plan
100% credited toward any paid service. Start with an audit, then let us fix what we find.
Frequently asked questions
Why does my API work in Postman but not in the browser?
CORS is enforced only by browsers. Postman, curl, and server-side code don't enforce CORS because they aren't protecting a user browsing a different website. The API works — it's the browser blocking the response.
Is it safe to set Access-Control-Allow-Origin to *?
For public APIs with no authentication, wildcard (*) is fine. For APIs that use cookies or Authorization headers, you must specify the exact allowed origin — wildcards are not permitted with credentials.
Related resources
Related Technologies
Still stuck? We can fix it for you.
Send us your repo. We'll diagnose the issue and give you a fixed quote within 24 hours.