CORS error
No 'Access-Control-Allow-Origin' header is present on the requested resourceThe browser blocked your page from reading another site's response, because that site did not allow your site to read it.
What it means
Your page asked a different origin (another domain, port or protocol) for data. The response did not carry an Access-Control-Allow-Origin header allowing your site, so the browser will not let your code read it.
This check is done by the browser. Tools such as curl do not do it, which is why the same request can work in a terminal and fail on your page.
Common causes
- You control the server, and it does not send the header. Add
Access-Control-Allow-Originwith your site's origin.*allows everyone, which suits public data only, and it does not work for requests that send credentials such as cookies. If you allow several origins by echoing back the request'sOrigin, check it against a list and also sendVary: Origin. - You do not control the server. You cannot add the header from your page. MDN's options are to make the request from your own server instead (a proxy, such as an API route), or, if you only need to send the request and never read the answer,
mode: "no-cors", which makes the response unreadable to your code. - A browser extension that turns CORS off only changes your own browser. Everyone else still gets the error.
A prompt to fix it
Paste it into your AI coding tool and fill in the parts in angle brackets. It asks the tool to find the cause and show you before it changes anything.
Paste it, then fill in the <angle brackets>
My browser console shows: Access to fetch at '<the URL>' from origin '<my site>' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
First tell me which case this is:
A. The URL is my own backend or API, and I can change its code or settings.
B. The URL is someone else's API.
If A: send the Access-Control-Allow-Origin header from that server for my site's origin only. Not *, unless the data is public and no cookies or credentials are sent. If more than one origin needs access and you echo the request's Origin, check it against a list and also send Vary: Origin.
If B: do not try to fix it in the browser. Move the request to my own server (an API route or server function) and have my page call that instead. Keep any API key on the server.
Do not switch to mode: 'no-cors' if my code needs to read the response: it makes the response unreadable. Do not suggest a browser extension.How to check it is fixed
- Reload with the console and the Network tab open. The request succeeds, and its response headers include
Access-Control-Allow-Originwith your site's origin. - Test from your deployed address too, not only localhost. It is a different origin, so it has to be allowed as well.
Tested prompts that help
- Hand It An Error — If the fix above does not do it, or your error is close to this one but not quite, this prompt hands your AI tool the whole error, what you expected, the last thing you changed and what you already ruled out, and makes it name the cause before it changes anything. Test log: Pass, ChatGPT (Pro), September 27, 2026; Pass, Claude.ai (Fable 5.1 Max), September 27, 2026.
Sources
Everything above comes from these pages. We read them on September 27, 2026; if one has changed since, it wins.