DevFixProDev Toolkit
Home / Errors / CORS policy blocked the cross-origin request
Web / HTTP

CORS policy blocked the cross-origin request

Browser / Web (fetch, XHR)

Access to fetch at 'https://api' from origin 'https://app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present.

What it means (root cause)

The browser enforced the same-origin policy: the cross-origin response did not include the Access-Control-Allow-Origin header (or didn't match your origin). The request may have succeeded server-side; the browser simply hid the response.

The symptom developers actually see: Access to fetch at 'https://api' from origin 'https://app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present.

How to avoid it: Define a CORS policy on the API once (allowed origins/methods/headers) instead of patching per route; the CORS Diagnostic tool maps the console error to the fix.

Step-by-step fix

Concrete, ordered steps from the dataset. Apply them in order; each line is a verified action, not generic advice.

  1. 1Have the API respond with Access-Control-Allow-Origin for your origin (or *) on the actual response and the OPTIONS preflight.
  2. 2If you control the server, set the header in middleware or Nginx/Apache (use the CORS Header Generator for exact config).
  3. 3For local dev, proxy the call through your own origin instead of calling the foreign API directly.

Where this error appears

Languages, frameworks, and runtimes where this error is observed (from the 2026 DevFixPro error dataset, retrieved 2026-08-29):

Browser / Web (fetchXHR)

Browsers only (Chrome/Firefox/Safari/Edge). curl and Postman don't enforce CORS, which is why it works there but fails in the browser.

How to prevent it & common questions

Practical prevention plus the questions developers ask most about this error.

What does "CORS policy blocked the cross-origin request" mean?

The browser enforced the same-origin policy: the cross-origin response did not include the Access-Control-Allow-Origin header (or didn't match your origin). The request may have succeeded server-side; the browser simply hid the response.

Which environments are affected by CORS policy blocked the cross-origin request?

Browser / Web (fetch, XHR)

How do I fix CORS policy blocked the cross-origin request?

Have the API respond with Access-Control-Allow-Origin for your origin (or *) on the actual response and the OPTIONS preflight. If you control the server, set the header in middleware or Nginx/Apache (use the CORS Header Generator for exact config). For local dev, proxy the call through your own origin instead of calling the foreign API directly.

How do I prevent CORS policy blocked the cross-origin request?

Define a CORS policy on the API once (allowed origins/methods/headers) instead of patching per route; the CORS Diagnostic tool maps the console error to the fix.

Why does it work in Postman but fail in the browser?

Postman and curl don't enforce the same-origin policy; browsers do. The missing CORS header only matters to the browser, so server-side calls succeed while fetch fails.

What is the fastest fix?

Have the API return Access-Control-Allow-Origin for your origin (or *). The CORS Header Generator produces the exact Nginx/Apache config.

Related DevFixPro tools

Real, browser-only utilities on DevFixPro that help while you work through this issue. These are navigation aids, not a substitute for the fix above.

CORS

CORS Error Diagnostic

Paste a CORS console error and get the likely cause and the server-side fix.

Open tool →
HEAD

CORS Header Generator

Generate Nginx / Apache CORS config and a matching fetch() example from your settings.

Open tool →
API

Cross-Origin API Request Builder

Build and send real GET/POST/PUT/DELETE requests from your browser to debug APIs and CORS.

Open tool →
● Data updated 2026-08-29

Sources & attribution

  • Error records aggregated from Google Search Console query gaps (2026-05-21~2026-08-18) for devfixpro.com, plus official framework docs (MDN, Node.js docs, Python docs, Go.dev, Rust book, Oracle Java docs, Docker docs, npm docs). Source dataset retrieved 2026-08-29. License: CC BY 4.0 — attribute DevFixPro (devfixpro.com).
  • Official reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
  • All cause, environment, fix and prevention text on this page is taken verbatim from the DevFixPro 2026 error dataset. DevFixPro does not invent root causes or fixes.
How this CORS policy blocked the cross-origin request page is built

Each error page is generated from a single record in the DevFixPro 2026 error dataset. The meaning, root cause, environments, fix steps, prevention, and official references are copied verbatim from that dataset and its official-doc sources; related-error links are computed from the error's category and explicit peer list. No root cause or fix is invented. The retrieval date for this dataset is 2026-08-29.

← Back to all errors