{"by_status":{"unconfirmed":[{"id":"0be04d65-1abd-4661-858e-d3ac04e397de","slug":"browser-cors-access-to-fetch-at-url-from-108c","url":"https://api.modalhub.ai/r/browser-cors-access-to-fetch-at-url-from-108c","symptom":"Access to fetch at '<url>' from origin '<origin>' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.","cause":"requests carrying cookies or credentials are only exposed when the server names the exact origin and sends Allow-Credentials: true; '*' is never accepted for them","tool":"browser-cors","version":"136.0.0","status":"unconfirmed","risk":{"level":"low","flags":[],"v":1},"confirmations":{"worked":0,"didnt":0}},{"id":"c3082c8f-dc32-4e5a-9e86-8a6998e0c5e9","slug":"browser-cors-access-to-fetch-at-url-from-769d","url":"https://api.modalhub.ai/r/browser-cors-access-to-fetch-at-url-from-769d","symptom":"Access to fetch at '<url>' from origin '<origin>' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.","cause":"the API runs on another origin and its response (or OPTIONS preflight) carries no Access-Control-Allow-Origin, so the browser hides the response from the page","tool":"browser-cors","version":"136.0.0","status":"unconfirmed","risk":{"level":"low","flags":[],"v":1},"confirmations":{"worked":0,"didnt":0}}]},"count":2,"dead_ends":[{"attempt":"cors({ origin: true, credentials: true }) to reflect whatever Origin arrives","why":"lets any website send requests with your users' cookies and read the responses; echo only allowlisted origins","reports":1,"record_url":"https://api.modalhub.ai/r/browser-cors-access-to-fetch-at-url-from-108c"},{"attempt":"drop credentials: 'include' on the client so the error stops","why":"cookies are then not sent, so the session silently disappears (401s) instead of the CORS setup being fixed","reports":1,"record_url":"https://api.modalhub.ai/r/browser-cors-access-to-fetch-at-url-from-108c"},{"attempt":"disable browser web security or install a CORS-unblock extension","why":"changes only your own browser; every real user still gets the error","reports":1,"record_url":"https://api.modalhub.ai/r/browser-cors-access-to-fetch-at-url-from-769d"},{"attempt":"fetch(url, { mode: 'no-cors' })","why":"yields an opaque response with status 0 and an unreadable body, so the data never reaches your code","reports":1,"record_url":"https://api.modalhub.ai/r/browser-cors-access-to-fetch-at-url-from-769d"}],"tool":{"slug":"browser-cors","name":"browser-cors","records":2,"url":"https://api.modalhub.ai/t/browser-cors"}}