CORS error fixes

Find the exact message from your browser console. Each page explains the cause, gives a curl command to check it, and shows the headers that fix it.

• Request header field is not allowed by Access-Control-Allow-Headers in preflight response: fix
  Fix 'Request header field authorization / content-type / x-api-key is not allowed by Access-Control-Allow-Headers in preflight response'.
• Method is not allowed by Access-Control-Allow-Methods in preflight response: fix
  Fix 'Method PUT/PATCH/DELETE is not allowed by Access-Control-Allow-Methods in preflight response' by listing the method on the OPTIONS response.
• No 'Access-Control-Allow-Origin' header is present on the requested resource: fix
  Why the browser says no Access-Control-Allow-Origin header is present, the hidden causes (errors, middleware order, proxies) and the fix.
• Response to preflight request doesn't pass access control check: fix
  Fix the CORS preflight error: OPTIONS returns 401, 403, 404 or 405, or lacks CORS headers. Answer OPTIONS with 204 before auth.
• Redirect is not allowed for a preflight request: fix
  Why the browser says redirect is not allowed for a preflight request: http to https, trailing slash or www redirects. Call the final URL directly.
• The value of Access-Control-Allow-Origin must not be the wildcard '*' when credentials mode is 'include'
  Fix the CORS error for '*' with credentials: echo an allowlisted origin, add Access-Control-Allow-Credentials: true and Vary: Origin.

Independent pages, not affiliated with or endorsed by any vendor mentioned.