CORS Redirect Errors: Inspect the Redirect Chain

Browser message #

Typical wording varies by browser:

Redirect is not allowed for a preflight request.

What it means #

The request crossed a redirect path that the browser could not complete under its CORS and redirect checks. Not every redirect is forbidden; inspect the specific hop and browser message.

Evidence to inspect #

Preserve the Network log. Check whether OPTIONS redirects, whether the API redirects to login, or whether the destination changes origin. A trailing-slash or HTTP-to-HTTPS redirect can occur before your application CORS middleware.

Smallest safe fix #

Use the API’s final HTTPS URL directly. Handle OPTIONS on that URL without a login redirect. For an API authentication failure, return a status such as 401 with the appropriate CORS policy instead of an HTML login redirect.

Example permission for an approved request (not a complete API policy):

HTTP/1.1 401 Unauthorized
Access-Control-Allow-Origin: https://app.example.com
Vary: Origin

In browser fetch, redirect: manual returns an opaqueredirect response with status 0 and inaccessible headers. It does not let you read Location and follow the redirect yourself. A server-side client can inspect hops, but cannot prove the browser accepts them.

Verify the fix #

Retry the final API URL from your frontend. Inspect OPTIONS and the actual response. If a cross-origin redirect remains necessary, test supported browsers and every relevant hop.

Use the CORS Tester to inspect public API headers or analyze a captured response. Confirm the result from the actual frontend afterward.

Continue learning #

A browser-first debugging workflow · Framework configuration · All errors

References #

• Fetch Standard: redirect responses