CORS Error Explainer

Your JavaScript only learns that a CORS request failed — the reason is printed in the console, and nowhere else. Paste that line (Chrome, Firefox and Safari word it differently), optionally the response headers, and get the exact case and a fix for your server.

Everything runs in your browser — nothing you paste is sent anywhere, and tokens, cookies and passwords are masked in the output.

Paste the console error, exactly as the browser printed it

Optional: response headers (curl -i / curl -v output)

Your server (for the fix snippet)

Try:

What gets checked

Missing Access-Control-Allow-Origin

on the response, or only on the OPTIONS preflight — and why a preflight happened at all (JSON body, Authorization header, PUT/DELETE)

'*' with credentials

credentials: 'include' or withCredentials needs an explicit origin plus Access-Control-Allow-Credentials: true

Origin mismatch and duplicates

http vs https, www vs apex, the port, a trailing slash, or two layers both setting the header

Preflight failures

OPTIONS answered 404/405, blocked by auth (preflights carry no credentials), or redirected

Headers and methods not allowed

including the rule that Access-Control-Allow-Headers: * never covers Authorization

When it is not CORS at all

a 500 hiding behind the CORS line, mixed content, network failures, file:// pages, and the no-cors / opaque trap

Why CORS errors are fixed on the server

CORS is the browser asking the server for permission to let your page read a cross-origin response. The permission is expressed in response headers — Access-Control-Allow-Origin and friends — so almost every fix is a server change. Client-side tricks do not help: mode: 'no-cors' gives you an opaque response (status 0, no headers, unreadable body), not your data.

Every diagnosis links the primary source it is based on: the browsers' own error strings (Chromium and WebKit source, Mozilla's MDN reference), the Fetch Standard, and the Next.js, Supabase, Express and Cloudflare documentation.

Shipping a Next.js + Supabase API?

CORS only decides which pages may read your responses — it is not access control. The launch checklist covers what is: Row Level Security, secret management and auth hardening.

Read the Next.js + Supabase production launch checklist

Step-by-step fixes for these errors

This tool runs on dev-error-explainers, an open-source, zero-dependency library — view the source on GitHub.