{
  "id": 9561321,
  "title": "Fix CORS before you blame the SDK",
  "url": "https://urgent.news/2026/09/24/fix-cors-before-you-blame-the-sdk",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-24T13:49:54.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/amorizz/fix-cors-before-you-blame-the-sdk-45b8"
  },
  "original_language": "en",
  "account": "CORS (Cross-Origin Resource Sharing) errors occur when a web application, running on one domain, tries to make requests to a different domain, and the server does not allow it. In this case, the issue lies with the server-side configuration, not the client-side SDK or fetch call. To resolve the problem, ensure that the API on https://api.example.com allows requests from the SPA running on https://app.example.com by specifying the correct Access-Control-Allow-Origin header in the response.",
  "summary": "TL;DR The bug is usually the preflight ( OPTIONS ), not your fetch call or the client library. Access-Control-Allow-Origin: * and credentials: 'include' never work together. Echo an exact origin from an allowlist — not a wildcard — when the SPA and API sit on different hosts. Your SPA lives on https://app.example.com . Your API lives on https://api.example.com . You open DevTools, hit a button,…",
  "key_points": [
    "CORS errors occur due to server-side configuration issue.",
    "API on https://api.example.com must allow requests from https://app.example.com.",
    "Specify correct Access-Control-Allow-Origin header in response."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}