Common CORS Errors

Read the message, inspect the failing response, then apply and verify the smallest safe fix. Start with the debugging workflow if the message is unclear.

Redirect errors

Diagnose login and canonical-URL redirects in cross-origin requests, without relying on unreadable manual redirects.

Credentials rejected

Fix wildcard origin permission for credentials mode include, then check cookies and authentication separately.

Invalid origin value

Return one valid origin or an appropriate wildcard. Diagnose duplicate headers from middleware, proxies and CDNs.

Method not allowed

Check whether Access-Control-Allow-Methods permits the actual method, independently of the endpoint’s HTTP routing.

Credential permission

Fix missing or invalid credential permission for include-mode requests without confusing CORS with cookie eligibility.

Header not allowed

Compare requested non-safelisted header names with Access-Control-Allow-Headers and explicitly allow Authorization.

Missing origin header

Find why origin permission is missing on OPTIONS or the actual response, then fix the server or proxy that owns the response.

Origin mismatch

Compare the request Origin with Access-Control-Allow-Origin exactly. Separate a browser CORS mismatch from Google OAuth origin_mismatch.

Failed preflight

Diagnose failing OPTIONS requests by checking HTTP status, redirects, origin permission, methods and request headers.

Fetch response types

Separate fetch network failures, opaque responses, unreadable headers and JSON parsing errors before changing your CORS policy.

Wildcard header rules

Understand when wildcard request-header permission works and why credentials or Authorization require explicit names.