When the browser sees this response with an appropriate access-control-allow-origin header, the browser allows the response data to be shared with the client site. On the server side, when a server sees this header, and wants to allow access, it needs to add an access-control-allow-origin header to the response specifying the requesting origin (or * to allow any origin.) When the browser is making a cross-origin request, the browser adds an origin header with the current origin (scheme, host, and port). the browser remembers that and allows cross-origin resource sharing. when you want to get a public resource from a different origin, the resource-providing server needs to tell the browser 'this origin where the request is coming from can access my resource'. Remember, the same-origin policy tells the browser to block cross-origin requests. use curl for example, it doesn't care about cors policies like browsers do and will get you what you want.

if using a reverse proxy such as nginx, configure nginx to send response headers that allow cors.

allow the server to receive cross-origin requests by explicitly stating it in the response headers.

serve the page from the same origin as where the requests you are making reside (same host).

It works, because the server which sends the http response included now a header stating that it is ok for cross-origin requests to happen to the server, this means the browser will let it happen, hence no error. Res.header('access-control-allow-origin', '*') the browser is stopping this attempt due to cors policy.īut if we uncomment the commented line: const express = require('express') Since the web page was not served from the localhost server on localhost:3000 and via the file explorer the origin is not the same as the server api origin, hence a cross-origin request is being attempted. res.header('access-control-allow-origin', '*') Īnd open a html file (that does a request to the localhost:3000 server) directory from the file explorer the following error will happen: If we host our own localhost api server running on localhost:3000 with the following code: const express = require('express') Same applies for if my page was served from a server on localhost: the browser will not allow this because of the cors policy which is set and that policy is that cross-origin requests is not allowed. in this instance origin null is trying to do a request to (a cross-origin request). The same-origin policy tells the browser to block cross-origin requests. If you open your web browser and open a local html file and in that html file there is javascript which wants to do a request to google for example, you get the following error: this website will most likely only fetch images, icons, js files and do api calls towards, basically it is calling the same server as it was served from. When you open your browser and go to, that website will have the origin of. What has this got to do with cors issues?

The same applies for if you open a local html file via your file explorer (which is not served via a server):

you can see this in chrome dev tools under security: when you open your web browser and go to, the origin of the web page that is displayed to you is. or could be a locally opened file file:// etc. The origin itself is the name of a host (scheme, hostname, and port) i.g. I'll have a go at this complicated subject.

Access control allow origin axios