CORS

You might say

The browser blocked this page's API request. Check whether CORS is not allowing this site.

CORS is the browser security mechanism that lets a page read a cross-origin response only after the server explicitly permits it.When a page on app.example.com requests api.example.com, the server must allow that page origin in its response before the browser gives the data to script. It protects cross-origin reads in browsers; the server still decides whether an API can be called and whether a user has permission.

Know first

HTTP API

Cross-Origin Resource Sharing

Why a cross-origin request needs server permission

http://localhost:3000

Originlocalhost:3000

GETlocalhost:8080/api

200 API reached

Response headersContent-Type: application/jsonWaiting for response headers…

Where CORS sits in the request path

An origin comes from the address: A different protocol, domain, or port can mean a different origin. A local page at localhost:3000 calling localhost:4000 is a common cross-origin case too.

The server declares the allowed scope: Before the browser exposes a response, it checks CORS response headers. A server should allow the real sites, methods, and credentials needed—not every origin just to remove an error.

Quick checkChoose the best answer

A local page at `localhost:3000` calls an API at `localhost:4000` and the console reports CORS. Which investigation is most accurate?

Check whether the API CORS configuration allows the `http://localhost:3000` origin and this request's method and credentialsTurn off login and authorization so CORS passes automaticallyPut a token in browser storage so the browser stops blocking the request

You can say this to an AI Agent

Investigate the CORS error when `http://localhost:3000` calls `http://localhost:4000`. Allow only the origin, methods, and credentials needed by this development page; do not open every origin. Then make a real browser request to verify it.

Learn next

1Browser Storage→