CORS policy error

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

# Add CORS headers in server config
Header add Access-Control-Allow-Origin "*"
# Or in Nginx
add_header Access-Control-Allow-Origin *;

How to diagnose Client errors

Client-side errors are what the browser console shows when something the page depends on cannot be loaded, parsed or executed. Two patterns dominate: the browser refused to make or read a request (CORS, mixed content, cookie policy), and the bundler or runtime could not resolve a module. Both produce alarming messages that point at the wrong file, so read the network tab before the stack trace.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

1. Open devtools and look at the failing request in the Network tab, not just the console message. CORS errors always have a real underlying response, or a real absence of one, that the console hides.
2. For CORS, remember the fix belongs on the server. No client-side change can grant your page access; browser extensions that appear to fix it only mask the problem in development.
3. Distinguish a preflight failure from a main-request failure. If you see an OPTIONS request in the network tab that returns a non-2xx, the server is not handling preflight at all.
4. For module resolution errors, check the exact specifier, the file extension and the case of the path. Case-insensitive filesystems on macOS and Windows hide errors that appear only on Linux CI.
5. Test in a private window with extensions disabled. Ad blockers and privacy extensions cause a surprising share of reported "CORS" and "network" errors.

Tools worth reaching for

• Browser devtools (Network + Console)
• curl -H 'Origin: …' -X OPTIONS -i
• Lighthouse
• private/incognito window

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

📖 developer.mozilla.org

Related Client errors

• Angular: Can't resolve all parametersAngular dependency injection cannot resolve constructor parameters. Missing providers…
• Browser warning: Cookie has no SameSite attributeModern browsers default cookies without SameSite to Lax, which may break cross-site login…
• docker: permission deniedUser lacks permissions to access the Docker daemon socket. Docker daemon requires root…
• Failed to fetch dynamically imported moduleA single-page app that was loaded before a deployment tried to lazy-load a chunk whose hashed…
• FATAL ERROR: JavaScript heap out of memoryNode.js process has exceeded the default memory limit (typically ~1.7GB). Large datasets…
• [email protected]: Permission denied (publickey)Git cannot authenticate with the remote repository using SSH keys. SSH key is missing…
• IndentationError: unexpected indentPython code has inconsistent indentation. Mixed tabs and spaces, or incorrect indentation…
• Java: java.lang.ClassNotFoundExceptionApplication tries to load a class through its string name but no definition for the class…

See all 21 Client errors →

Browse other categories

• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.