The console screams CORS
You call an API from the browser and get "blocked by CORS policy". The browser hid the response, so you cannot even see what the server said. You need to know which of the several CORS failure modes you hit.
Diagnose, then generate
Start with the CORS Diagnostic: paste the full console error and it classifies the cause — missing Access-Control-Allow-Origin, a failed preflight (OPTIONS), a credentials/Origin mismatch, or a redirect. Then open the CORS Header Generator to produce the matching Nginx or Apache block.
Worked example
Error mentions No 'Access-Control-Allow-Origin' header. The generator outputs add_header 'Access-Control-Allow-Origin' 'https://your.app' always; plus an OPTIONS → 204 handler for preflight. Drop it into the server block and the browser call succeeds.
Boundaries
- CORS is enforced by the browser, so the fix is always on the server (or a proxy) — client code alone cannot remove it.
- If Allow-Credentials is true, Allow-Origin must be the exact origin, never
*.
FAQ
Why does it work from curl? curl ignores CORS; only browsers enforce it. That is why server-side tests pass but the page fails.
Still failing after adding headers? Check for a redirect on the API path or a missing OPTIONS handler — both break preflight.