Developer tools
How to debug CORS errors in the browser
Learn how to diagnose CORS errors step by step: what the browser message means, which headers to check, and how to fix the server.
Document summary
A guide to diagnosing CORS errors: reading the browser message, checking response headers, and fixing the server side.
Key takeaways
- CORS is enforced by the browser, not the server
- The error message names the missing header
- Fix the server response, never disable the browser check
What the browser actually checks
When a page on origin A calls an API on origin B, the browser adds an Origin header and only exposes the response if the server answers with the right Access-Control-Allow-* headers.
The check runs in the browser, which is why curl succeeds while the page fails: curl does not enforce CORS.
Read the browser error message
- "No Access-Control-Allow-Origin header" means the header is missing entirely
- "Origin ... is not allowed" means the header is present but does not include your origin
- Preflight failures mention OPTIONS and Access-Control-Allow-Methods or Headers
Debug with the analyzer
- 1
Reproduce the failing request and capture the response headers with the CORS header analyzer.
- 2
Compare the required headers with what the server returned.
- 3
Fix the server configuration for the missing or wrong header.
- 4
Retest from the same origin the browser uses.
Common server fixes
- Echo the request Origin for credentialed requests
- Allow the specific methods and headers the client sends
- Handle OPTIONS preflight requests explicitly
- Keep Access-Control-Allow-Credentials true consistent with non-wildcard origins
Frequently asked questions
Why does my API work in curl but fail in the browser?
CORS is enforced only by browsers. curl sends no Origin header, so the check never runs.
What is a preflight request?
For requests with custom headers or methods, browsers send an OPTIONS request first and proceed only if the server allows it.
Can I disable CORS to fix the error?
No. The browser enforces it for your safety. Fix the server response instead.
Is my request data uploaded?
No. Header analysis runs locally in your browser.
