No Access-Control-Allow-Origin Header — Fix

Your server processed the request and returned a response — but the response is missing Access-Control-Allow-Origin. The browser blocked it before JavaScript could read it.

The fix — add the header to your server response

Express (Node.js)

const cors = require('cors');
app.use(cors({ origin: 'https://app.example.com' }));

Nginx

add_header Access-Control-Allow-Origin "https://app.example.com" always;

FastAPI (Python)

from fastapi.middleware.cors import CORSMiddleware
app.add_middleware(CORSMiddleware, allow_origins=["https://app.example.com"])

Django

pip install django-cors-headers
# settings.py: CORS_ALLOWED_ORIGINS = ['https://app.example.com']

Next.js (vercel.json)

{ "headers": [{ "source": "/api/(.*)", "headers": [
  { "key": "Access-Control-Allow-Origin", "value": "https://app.example.com" }
]}]}

Not sure which fix applies to your stack? CORSFixer sends a real OPTIONS preflight to your API and shows exactly what is missing.