CORSJavaScriptJun 2026

Access to fetch blocked by CORS policy

Error Message

terminal

Access to fetch at 'https://api.example.com/data' from origin 'http://localhost:3000'
has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present.

Root Cause

The backend API did not send the Access-Control-Allow-Origin header. CORS is enforced by the browser on all cross-origin requests — the server must explicitly allow the origin.

Fix

solution

// Express (Node.js) — install and use cors middleware
import cors from 'cors'

app.use(cors({
  origin: 'http://localhost:3000', // or '*' to allow all
}))

// Or set headers manually
app.use((req, res, next) => {
  res.setHeader('Access-Control-Allow-Origin', 'http://localhost:3000')
  res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE')
  next()
})

Takeaway

CORS is enforced by the browser, not the server. Fix it on the server by adding the correct headers — you cannot work around it client-side.

HTTPExpressBrowser