{
  "id": 14965244,
  "title": "CORS Explained: Why It's a Browser Problem (and How to Fix It on the Server)",
  "url": "https://urgent.news/2026/10/16/cors-explained-why-its-a-browser-problem-and-how-to-fix-it-on-the",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-16T13:43:01.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/weatherclockdash/cors-explained-why-its-a-browser-problem-and-how-to-fix-it-on-the-server-1l86"
  },
  "original_language": "en",
  "account": "CORS (Cross-Origin Resource Sharing) is a common source of confusion for developers, with cryptic error messages and counterintuitive behavior. The issue typically lies on the server side, not the browser. This guide explains how CORS works, why errors occur, and how to configure it correctly.\n\nA cross-origin request occurs when two URLs share different origins due to differences in protocol, host, port, or subdomain. When JavaScript in a browser makes a fetch/XHR request to a different origin, the browser enforces CORS rules, even if the request succeeds on the server.\n\nThere are two types of CORS requests: simple and preflighted. Simple requests are straightforward, using GET, POST, or HEAD methods and specific content types. The browser sends the request and checks the Access-Control-Allow-Origin header in the response. If the header matches or is wildcard (*), the browser allows JavaScript to read the response.\n\nPreflighted requests, on the other hand, involve more complex methods like PUT or DELETE, custom headers, or JSON content types. The browser first sends an OPTIONS preflight request to determine if the actual request is safe to send. The server must respond to the preflight before proceeding with the actual request. If the preflight response is missing or incorrect, the actual request won't fire.\n\nCommon CORS error messages include the absence of the Access-Control-Allow-Origin header, using wildcard (*) when credentials mode is \"include,\" the DELETE method not being allowed by Access-Control-Allow-Methods, and the Authorization header being disallowed by Access-Control-Allow-Headers.\n\nTo fix CORS issues, server-side configuration is required. In Express (Node.js), the cors middleware can be used to add the necessary headers. Specify allowed origins, methods, headers, and credentials mode as needed. In Nginx, add the appropriate headers for origin, credentials, methods, and headers, and handle OPTIONS requests appropriately.",
  "summary": "CORS (Cross-Origin Resource Sharing) is responsible for more confused developer Stack Overflow questions than almost any other browser feature. The error messages are cryptic, the behavior is counterintuitive, and the fix is almost always on the server — not the browser. This guide covers how CORS actually works, why you're seeing these errors, and how to configure it correctly. What Is a…",
  "key_points": [
    "CORS is a browser problem caused by different origins in URLs",
    "Simple requests use GET, POST, or HEAD methods with specific content types",
    "Preflighted requests involve complex methods, custom headers, or JSON content types"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}