CORS Error Messages Explained — Fix Every Browser Console Error

Updated April 2026

CORS error messages are cryptic. This is every error you will see in Chrome, Firefox, and Safari — decoded and with the exact fix.

The errors

"No 'Access-Control-Allow-Origin' header is present"

Access to fetch at 'https://api.example.com' from origin 'https://app.example.com'
has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present
on the requested resource.

Cause: Your server is not returning the Access-Control-Allow-Origin header.

Fix: Add the header to your server response:

add_header Access-Control-Allow-Origin "https://app.example.com" always;

"The value of the 'Access-Control-Allow-Origin' header does not match"

The value of the 'Access-Control-Allow-Origin' header in the response must not be
the wildcard '*' when the request's credentials mode is 'include'.

Cause: You are using credentials: 'include' (cookies/auth) with a wildcard origin.

Fix: Replace * with the specific origin:

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true

"Response to preflight request doesn't pass access control check"

Response to preflight request doesn't pass access control check: No
'Access-Control-Allow-Origin' header is present on the requested resource.

Cause: Your server returns CORS headers on GET/POST responses but not on OPTIONS (preflight) responses.

Fix: Handle OPTIONS explicitly:

if ($request_method = OPTIONS) { add_header Access-Control-Allow-Origin "https://app.example.com"; add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"; add_header Access-Control-Allow-Headers "Content-Type, Authorization"; return 204;
}

"Method PUT is not allowed by Access-Control-Allow-Methods"

Cause: Your Access-Control-Allow-Methods header does not include the method being used.

Fix: Add the missing method:

Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS

"Request header field Authorization is not allowed"

Request header field Authorization is not allowed by Access-Control-Allow-Headers
in preflight response.

Cause: Your server doesn't include Authorization in Access-Control-Allow-Headers.

Fix:

Access-Control-Allow-Headers: Content-Type, Authorization

"CORS request did not succeed" (Firefox)

Cause: The OPTIONS preflight returned a non-2xx status code, or the server is completely unreachable for OPTIONS requests.

Fix: Ensure OPTIONS returns 204 (not 404 or 405). Check that your server handles OPTIONS for the specific path — some frameworks block OPTIONS by default.

"CORS Missing Allow Header" (Safari)

Safari's message for missing Access-Control-Allow-Headers on preflight response. Fix is the same — add the header to your OPTIONS response.

Debugging CORS step by step

1. Open DevTools → Network tab
2. Find the OPTIONS preflight request (it will be before the actual request)
3. Check the response headers — what CORS headers are present?
4. Check the response status — it should be 200 or 204, not 404 or 405
5. Paste both URLs into CORSFixer to see the full diagnosis