"blocked by CORS policy: No Access-Control-Allow-Origin header": the fix
Browsers only let a web page read answers from another website if that website says so, using a header called Access-Control-Allow-Origin. The request often reaches the server fine; the browser just refuses to hand you the answer.
The error looks like this:
Access to fetch has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resourceHow to fix it
- Find which address is being called. The console error shows the URL. If it is a different site from your page (different domain, port or http/https), CORS applies.
- If you control that server, add the header. Make it answer with
Access-Control-Allow-Originset to your site's address, for examplehttps://example.com. - Use
*only for public data. A wildcard (*) is fine for a public API anyone may read. It does not allow cookies, and MDN says not to use it for private APIs. - If you do not control the server, go through your own backend. Have your own server call the other service and return the answer to your page; your server can add the header.
- Do not reach for
no-cors. It lets the request go out but you cannot read the answer, so it rarely solves the problem.
What you should see
The browser console no longer shows the CORS message and your page can read the response.
Not fixed? Bring the exact message to Bilo and we will look at it with you.
Still stuck? Paste your error into BiloQuick questions
Why does it work in Postman or curl?
CORS is enforced by browsers only. Those tools do not apply it.
Can I fix it from my page's code?
No. The fix has to come from the server that sends the response, or from a backend you put in the middle.
What about preflight?
For some requests the browser first asks the server for permission with an OPTIONS request. The server must answer that too; ask your AI tool to handle OPTIONS.
Sources and date checked
- MDN: CORS error, Access-Control-Allow-Origin missing: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS/Errors/CORSMissingAllowOrigin (checked 2026-11-01)
Written in our own words from the official pages above. Tool names are only references; we are not affiliated with them. Commands change between versions, so check the linked docs if something differs.