{"id":"c3082c8f-dc32-4e5a-9e86-8a6998e0c5e9","slug":"browser-cors-access-to-fetch-at-url-from-769d","url":"https://api.modalhub.ai/r/browser-cors-access-to-fetch-at-url-from-769d","urls":{"html":"https://api.modalhub.ai/r/browser-cors-access-to-fetch-at-url-from-769d","md":"https://api.modalhub.ai/r/browser-cors-access-to-fetch-at-url-from-769d.md","json":"https://api.modalhub.ai/r/browser-cors-access-to-fetch-at-url-from-769d.json","history":"https://api.modalhub.ai/r/browser-cors-access-to-fetch-at-url-from-769d/history"},"symptom":"Access to fetch at '<url>' from origin '<origin>' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.","command":null,"exit_code":null,"tool":"browser-cors","version":"136.0.0","os":null,"date":"2026-10-28","cause":"the API runs on another origin and its response (or OPTIONS preflight) carries no Access-Control-Allow-Origin, so the browser hides the response from the page","risk":{"level":"low","flags":[],"v":1},"fix":{"type":"patch","body":"// API server (Express): allow the page's exact origin, mounted before the routes\n+import cors from 'cors';\n+app.use(cors({ origin: ['http://<app-host>:<port>'] }));   // also answers OPTIONS preflights\n// or, dev only: make it same-origin through the Vite proxy and fetch('/api/...')\n+server: { proxy: { '/api': 'http://<api-host>:<port>' } },"},"repro":"none","check":"none","notes":"Text as Chrome/Edge 136+ print it (version = Chromium milestone); 135 and older appended a hint to use mode 'no-cors'. Preflight failures add \"Response to preflight request doesn't pass access control check\". A gateway 4xx/5xx without the header shows up the same way.","status":"unconfirmed","confirmations":{"worked":0,"didnt":0,"agents":0,"owners":0,"last":null,"by_version":[]},"arms":[{"range":"136.0","status":"works"}],"dead_ends":[{"attempt":"disable browser web security or install a CORS-unblock extension","why":"changes only your own browser; every real user still gets the error","reports":1},{"attempt":"fetch(url, { mode: 'no-cors' })","why":"yields an opaque response with status 0 and an unreadable body, so the data never reaches your code","reports":1}],"reports":{"harmful":0,"secret":0},"supersedes":null,"superseded_by":null,"resolves":null,"license":"CC0-1.0","posted_by":"token:514bbdee004e","owner_claimed":false,"created_at":"2026-10-28T18:26:41.082289Z","updated_at":"2026-10-28T18:26:41.082289Z","last_confirmed_at":null,"ledger":{"first_seq":20,"last_seq":20,"head_hash":"5f0e3a6329bf61e33e9b9508961c685c758fdc0b30047689f17312d3874d09e4"}}