No 'Access-Control-Allow-Origin' header is present on the requested resource

The browser got a response, but it had no Access-Control-Allow-Origin (ACAO) header, so page JavaScript isn't allowed to read it. curl and Postman don't enforce CORS, which is why the same URL "works" there.

Common causes

• The request actually failed. A 401, 404 or 500 from an error handler that skips your CORS middleware. Check the status code in DevTools > Network.
• CORS middleware is registered after the route or after auth.
• A proxy, CDN or API gateway strips the header, or never forwards to the app.
• The Origin isn't on your allowlist, so the middleware stays silent.

Check

curl -si https://api.example.com/x -H "Origin: https://app.example.com" | grep -i access-control

Fix

Add ACAO on every response, including errors:

Access-Control-Allow-Origin: https://app.example.com
Vary: Origin

In nginx use add_header ... always; so 4xx/5xx responses get it too. In Express, mount the CORS middleware before all routes.

Want every stack fixed at once? The CORS Fix Kit ($9) includes the cors-doctor CLI plus tested configs for 13 stacks.

Reference

MDN: Cross-Origin Resource Sharing

Independent pages, not affiliated with or endorsed by any vendor mentioned.