CORS is enforced by the browser, not teh server, which is why Postman and curl work 🤷 The fix is always on teh server: it must answer with Access-Control-Allow-Origin matching your sites origin. Adding headers to ur fetch call cant fix it, and mode: 'no-cors' just gives u an unreadable opaque response. worked for me anyway 🤷
I'm building a static site on a CDN and trying to fetch data from a form-hnadling service. postman returns the data perfectly. the browser gives me this:
the console says the request has been blocked by CORS policy, no Access-Control-Allow-Origin header is present. i dont understand why teh same request works in one tool and not the other :/ is this something i fix in my code or on the API side? lmao A plain explanatoin would honestly help as much as teh fix itself.
yeah so the OPTIONS request gets a 404. the actual GET never fires. hope thats enough info 😅
CORS is enforced by the browser, not teh server, which is why Postman and curl work 🤷 The fix is always on teh server: it must answer with Access-Control-Allow-Origin matching your sites origin. Adding headers to ur fetch call cant fix it, and mode: 'no-cors' just gives u an unreadable opaque response. worked for me anyway 🤷
hmmmm not sure about that id be careful with blanket backend proxies.. :) if you forward everything without validation, youve built an open relay to someone elses API... restrict what the proxy allows. just my 2 cents
@latetrace WOWWW set the explicit origin plus Allow-Credentials instead of teh wildcard... works in production now, cant believe it was one header. thank u thank u thank u
Sign in or create an account to reply.
