← All posts

What CORS Errors Are and How to Fix Them

CORS errors happen when a website tries to talk to another site but the other site says ‘not allowed’, like a waiter refusing your order.

🚀 The Simple Version

What is CORS?

CORS stands for Cross‑Origin Resource Sharing. Think of the web as a neighborhood of restaurants (websites). Each restaurant has a rule: only customers from certain tables (domains) can order from them. CORS is the set of rules that tell the browser if a request from one table to another is allowed.

Why the browser blocks it

When you load a page from example.com and it asks for data from api.example.org, the browser checks the response headers. If the server says “I don’t trust you,” the browser stops the request and shows a CORS error. It’s a safety feature to keep data private.

Common fix: enable CORS on the server

On the server that owns the data, add a header that says who can talk to it. For example, in Express.js you can write:

app.use((req, res, next) => {
  res.setHeader('Access-Control-Allow-Origin', '*'); // or specific domain
  next();
});

In many frameworks you’ll find a CORS middleware you can enable with a single line.

Quick fixes for developers

  • Use a browser extension that temporarily disables CORS checks (good for testing only).
  • Run a local proxy that adds the header for you.
  • If you control both sites, put them on the same domain or use a subdomain trick.

When you’re stuck: use a proxy

Set up a simple Node or Python proxy that forwards your request and adds the needed header. Example with Node:

const express = require('express');
const request = require('request');
const app = express();
app.get('/proxy', (req, res) => {
  request({ url: req.query.url }).pipe(res);
});
app.listen(3000);

Then your front‑end calls http://localhost:3000/proxy?url=https://api.example.org/data and the browser sees it as the same origin.