Articles/HTTP

What Is CORS and Why Does It Block My API Requests?

CORS is a browser security mechanism that blocks cross-origin requests unless the server explicitly allows them. Learn how it works and how to fix common CORS errors.

Published September 20, 2026

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that blocks JavaScript from making requests to a different origin (different domain, protocol, or port) than the page it's running on, unless the target server explicitly allows it via response headers.

Common causes

  • The Same-Origin Policy is a foundational browser security rule preventing malicious sites from silently reading data from another site (like your bank) using a logged-in user's cookies
  • CORS is the mechanism servers use to selectively relax that policy for specific origins that should be allowed to make cross-origin requests

How to fix it

  • The server must respond with an Access-Control-Allow-Origin header naming the allowed origin (or * for any origin, though that disables credentialed requests)
  • For requests with methods other than simple GET/POST, or custom headers, the browser first sends an OPTIONS 'preflight' request — the server must respond to OPTIONS with the appropriate CORS headers for the real request to proceed
  • CORS errors can only be fixed on the server — no amount of client-side JavaScript configuration can bypass a server that hasn't enabled CORS for your origin

Example

Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization

FAQ

Is CORS enforced by the server or the browser?

The browser enforces it — the server just declares which origins are permitted via response headers. A non-browser client (like curl or a backend server) isn't restricted by CORS at all.

More HTTP articles