Cómo Solucionar el Error CORS: Falta el Encabezado Access-Control-Allow-Origin

Cómo Solucionar el Error CORS: Falta el Encabezado Access-Control-Allow-Origin

A client-side web application running on Origin A (e.g., https://app.example.com) makes an asynchronous HTTP fetch() or XMLHttpRequest to an API on Origin B (e.g., https://api.example.com). The browser halts the response and logs a fatal CORS security exception.

Why does Cómo Solucionar el Error CORS: Falta el Encabezado Access-Control-Allow-Origin occur?

When Origin A calls Origin B, the browser automatically attaches an Origin: https://app.example.com request header. The server must evaluate this header and respond with Access-Control-Allow-Origin. If this header is missing, empty, or mismatches the origin, the browser immediately discards the response payload and raises a JavaScript TypeError.

How to Confirm You Are Facing This Exact Issue

Explicit Diagnostic Reasoning

Follow these diagnostic rules to isolate the root cause within 60 seconds:

Long-Term Engineering Solution

Configura el servidor para incluir Access-Control-Allow-Origin con el dominio exacto de tu cliente o gestiona las solicitudes preflight OPTIONS devolviendo el código 204.

How do you fix this step-by-step?

import express from 'express';
import cors from 'cors';

const app = express();

const allowedOrigins = [
  'https://app.example.com',
  'http://localhost:5173',
];

// MUST be declared before any route handlers
app.use(cors({
  origin: (origin, callback) => {
    // Allow requests with no origin (like mobile apps or curl)
    if (!origin || allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error('Blocked by CORS policy'));
    }
  },
  credentials: true, // Allow cookies / Authorization headers
}));

What are common misconceptions and mistakes when fixing this?

Can this fix introduce security vulnerabilities?

Misconfiguring CORS can allow malicious third-party websites to make authenticated requests to your API and exfiltrate sensitive user data.

Fixing Missing CORS Headers in Nginx Reverse Proxy

# BROKEN: Nginx forwards request but omits CORS headers
location /api/ {
    proxy_pass http://backend_upstream;
}

# FIXED: Nginx dynamically checks Origin and sets response headers
location /api/ {
    if ($http_origin ~* "^https?://(app\.example\.com|localhost:5173)$") {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization' always;
        add_header 'Vary' 'Origin' always;
    }

    if ($request_method = 'OPTIONS') {
        return 204;
    }

    proxy_pass http://backend_upstream;
}

Frequently Asked Questions About Cómo Solucionar el Error CORS: Falta el Encabezado Access-Control-Allow-Origin

Deeper Conceptual Inquiries