CORS Error

CORS Error: Access Blocked

Last updated: April 2026

Browser Console

Access to fetch at 'https://api.yoursite.com' from origin 'https://yourapp.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present.

The server response is missing the Access-Control-Allow-Origin header. This is always a server-side fix — not something you can fix in your frontend code.

Test CORS live →

Fix for Nginx

location /api/ {
    add_header Access-Control-Allow-Origin "https://yourapp.com" always;
    add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
    add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
    if ($request_method = OPTIONS) {
        add_header Access-Control-Allow-Origin "https://yourapp.com";
        return 204;
    }
    proxy_pass http://backend;
}

Fix for Express

const cors = require('cors');
app.use(cors({ origin: 'https://yourapp.com', credentials: true }));

Fix for FastAPI

app.add_middleware(CORSMiddleware,
    allow_origins=["https://yourapp.com"],
    allow_credentials=True, allow_methods=["*"], allow_headers=["*"])

Common causes

No CORS middleware — add cors() to your framework before routes.

Preflight OPTIONS not handled — POST with JSON body triggers a preflight. Your server must respond to OPTIONS requests.

Wrong origin in allowlist — check for trailing slashes, HTTP vs HTTPS, and port differences.