Get a $149 diagnosis

Error library

CORS error after deploy: Access-Control-Allow-Origin missing

Firefox reports this as "Reason: CORS header 'Access-Control-Allow-Origin' missing"; Chrome shows a similar "blocked by CORS policy" message. The browser blocked the response because your API did not return an Access-Control-Allow-Origin header for your production origin. Configure the API (not the frontend) to allow your deployed domain and to answer OPTIONS preflight requests.

Cause: The server's CORS allowlist still only includes localhost, or the preflight request fails before your handler runs.

How to fix it

  1. Find the exact origin in the error (scheme + host + port).
  2. Add that origin to the API's CORS allowlist and redeploy the API.
  3. Make sure OPTIONS preflight returns 2xx with the allowed methods and headers.
  4. If sending cookies, set Access-Control-Allow-Credentials: true and a specific origin, never *.

Example

Illustrative example, not from a customer project.

  app.use(cors({
-   origin: 'http://localhost:5173',
+   origin: ['http://localhost:5173', 'https://app.example.com'],
    credentials: true,
  }))

FAQ

Can I fix CORS in the frontend?

No. CORS is enforced by the browser based on headers the server sends.

Why not allow `*`?

* cannot be used with credentialed requests and exposes your API to any site.

Get a $149 diagnosis See pricing Launching soon? The Launch Path gets you ready for $1,195 flat.

$149Get a $149 diagnosis