Fix Express CORS Error: No 'Access-Control-Allow-Origin' Header

What's Actually Happening#

The browser blocked the response, not the server. Your Express API received the request and responded fine. The browser checked the response headers, did not find Access-Control-Allow-Origin, and blocked your JavaScript from reading the response.

Two things follow from this:

• curl and Postman do not enforce CORS. If your API works there but fails in the browser, CORS is the problem.
• Adding the right response headers to Express is the entire fix.

The Quickest Fix#

npm install cors

const express = require('express')
const cors = require('cors')

const app = express()
app.use(cors())

cors() with no arguments allows every origin. It unblocks you in development but do not ship this to production. Any website can hit your API.

Production Setup#

Lock it to your actual frontend URL:

const corsOptions = {
  origin: process.env.ALLOWED_ORIGIN || 'https://yourdomain.com',
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
}

app.use(cors(corsOptions))

Set ALLOWED_ORIGIN in your production environment variables. No code changes needed when you deploy to a new domain.

Warning: origin: '*' and credentials: true together are rejected by browsers. If you are sending cookies or auth headers, you must specify the exact origin.

Multiple Origins#

const allowedOrigins = [
  'https://yourdomain.com',
  'https://staging.yourdomain.com',
  'http://localhost:3000',
]

app.use(cors({
  origin: (origin, callback) => {
    if (!origin) return callback(null, true)
    if (allowedOrigins.includes(origin)) {
      callback(null, true)
    } else {
      callback(new Error(`CORS blocked: ${origin}`))
    }
  },
  credentials: true,
}))

Preflight Requests#

Browsers send a preflight OPTIONS request before any POST, PUT, DELETE, or request with custom headers like Authorization. If Express does not respond to OPTIONS correctly, the real request never fires.

The cors package handles this automatically, but only if it runs before your routes:

// cors before routes
app.use(cors(corsOptions))
app.use(express.json())
app.use('/api', router)

// cors after routes — preflight fails
app.use('/api', router)
app.use(cors(corsOptions))

If you are still seeing preflight failures, add an explicit handler:

app.options('*', cors(corsOptions))
app.use(cors(corsOptions))

Credentials and Auth Headers#

If your frontend sends cookies or an Authorization header:

// Frontend
fetch('https://api.yourdomain.com/users', {
  credentials: 'include',
  headers: { 'Authorization': `Bearer ${token}` },
})

Your Express server needs to match:

app.use(cors({
  origin: 'https://yourdomain.com',
  credentials: true,
}))

Note: The error Access-Control-Allow-Origin must not be '*' when credentials mode is 'include' means you have origin: '*' and credentials: true together. Replace '*' with your exact frontend URL.

Without the cors Package#

app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', 'https://yourdomain.com')
  res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
  res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization')
  res.header('Access-Control-Allow-Credentials', 'true')

  if (req.method === 'OPTIONS') return res.sendStatus(200)
  next()
})

Diagnosing the Exact Cause#

# Test without CORS enforcement
curl -I http://localhost:3001/api/users

# Simulate a preflight request
curl -X OPTIONS http://localhost:3001/api/users \
  -H "Origin: http://localhost:3000" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: Content-Type" \
  -v

Look for Access-Control-Allow-Origin in the response. If it is missing, cors() is not running on that route. If it is * and you are sending credentials, that is the mismatch.

Quick Reference#

For CORS issues behind an nginx proxy, across multiple API subdomains, or when auth middleware runs before your CORS config, paste your Express setup into DebugAI. It traces the middleware chain and shows exactly where the headers are getting dropped.