No Access-Control-Allow-Origin Header: Diagnose and Fix It
By Ankit Jain · Updated
Find why origin permission is missing on OPTIONS or the actual response, then fix the server or proxy that owns the response.
Browser message
Typical wording varies by browser:
No Access-Control-Allow-Origin header is present on the requested resource.
What it means
The response being checked does not grant your frontend origin permission. Adding this header to the frontend request does not fix the response.
Evidence to inspect
Find the failed URL and its status in Network. Inspect OPTIONS separately from the actual request. A 401 login response, 404 route, or 502 gateway page may come from a different layer than your normal API response.
Smallest safe fix
Configure the API or the proxy that produced the response to permit the approved frontend origin. Run CORS middleware before routes and application error handlers. If a gateway generates the error, its response needs the policy too.
Example permission for an approved request (not a complete API policy):
Access-Control-Allow-Origin: https://app.example.com
Vary: OriginFor a deliberately public API without credentials, wildcard permission can be appropriate. It is not suitable for credentialed reads. Do not reflect every supplied Origin on private endpoints.
Verify the fix
Check both a successful response and a controlled error response from the real frontend. JavaScript should be able to read the error status; authentication must still reject unauthorized access.
Use the CORS Tester to inspect public API headers or analyze a captured response. Confirm the result from the actual frontend afterward.
Continue learning
CORS on API error responses · Framework configuration · All errors