If a browser reports a CORS error only in production, inspect the production network exchange before changing policy. Check whether an OPTIONS preflight was sent, whether its response permits the requested origin, method, and headers, and whether the actual response allows the page to read it. Then investigate preflight caching and HTTP response caching as separate issues.
Why does CORS work locally but fail in production?
CORS is a browser-enforced way for a server to say which origins may read a cross-origin response. It is not usually a network failure: the server may receive a request and send a response, while the browser prevents your JavaScript from reading that response. JavaScript commonly gets a generic failure; the browser console and Network panel provide the details. MDN notes that the browser console is the way to determine specifically what went wrong in a CORS failure (MDN’s CORS guide).
As an Amazon Associate I earn from qualifying purchases.
Local and production requests can differ in origin, URL, method, headers, credential mode, redirects, or the responses returned by the production path. A production-only symptom does not, by itself, identify a CDN, proxy, browser cache, or deployment setting as the cause. Compare what the browser actually sent and received.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to diagnose the production failure
- Reproduce it in the failing browser context. Record the page origin (scheme, host, and port), target URL, method, request headers, and whether the client includes credentials. Note whether the issue affects every user or only some.
- Inspect the Network panel and console. Find the request and determine whether the browser sent an
OPTIONSrequest first. Check its status, any redirects, and response headers. A failed preflight can stop the browser from sending the actual request. - Validate the preflight response. Compare the request’s
Origin,Access-Control-Request-Method, and anyAccess-Control-Request-Headerswith the server’sAccess-Control-Allow-Origin,Access-Control-Allow-Methods, andAccess-Control-Allow-Headers. The response must permit the origin, method, and headers the browser requested. - Inspect the actual response separately. If the actual request was sent, check its response headers too. A successful preflight does not guarantee that the actual response is readable to the browser.
- Compare production responses across origins. If the server selects an explicit
Access-Control-Allow-Originbased on the request’sOrigin, confirm that the relevant response includesVary: Origin. Compare headers received through the production path for different requesting origins; a missing variation header is a cache-correctness issue to investigate, not proof that a particular cache caused the failure. - Retest after a narrow server-side fix. Use a fresh browser context and verify the new preflight and actual response. Most CORS corrections belong on the server, not in frontend workarounds.
Why does my OPTIONS preflight fail?
A preflight is a separate browser-generated OPTIONS request. It asks whether the server will permit the intended cross-origin request, which may use a method, header, or content type outside the CORS safelist. The browser communicates the intended method in Access-Control-Request-Method and may list headers in Access-Control-Request-Headers. The server must answer with permissions that cover those requested values.
#1 Best Overall
Credentials are not sent on the preflight itself. If credentials are needed for the actual request, however, the preflight response must allow credentials before the browser proceeds. Inspect the OPTIONS exchange as its own transaction; do not infer its result from the actual request or vice versa. MDN documents the request and response behavior in its CORS guide.
Also check whether OPTIONS receives a redirect or is handled differently by middleware or infrastructure than the actual method. Some browsers do not follow redirects after preflighted requests, so a redirect can matter; the presence of a redirect in a particular incident must be confirmed in the Network panel.
Rank #2
How credentials change the CORS headers
For a request that includes cookies or other credentials, the server cannot use Access-Control-Allow-Origin: *. It must return the specific permitted origin and Access-Control-Allow-Credentials: true. That header’s valid value is true; it is not a list, and false is not a meaningful way to disable credential permission. If credentials are unnecessary, omit the credentials header and do not ask the client to include them.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Endpoint behavior | Origin and credential response |
|---|---|
| Public endpoint that does not use credentials | Access-Control-Allow-Origin: * may be used; credentials permission is not needed. |
| Endpoint that requires cookies or other credentials | Return the explicitly permitted origin and Access-Control-Allow-Credentials: true; do not use a wildcard origin. |
For credentialed requests, keep the allowed-origin list limited to trusted origins and the resources that need access. Reflecting arbitrary Origin values or allowing broad credentialed access can expose data to unauthorized origins and increase cross-site request forgery (CSRF) risk. CORS permission and cookie policy are also distinct: browser third-party-cookie rules can still prevent cookies from being sent or accepted even when CORS headers permit the request. See MDN’s credentialed-request guidance and the OWASP CSRF overview.
Rank #3
Can a cached preflight or CDN response hide your fix?
There are two different kinds of caching to check. A browser may reuse a preflight permission according to Access-Control-Max-Age. Separately, an HTTP cache may store responses, which must vary correctly when response headers depend on the request origin. Neither behavior establishes that a cache caused a specific production error.
Browser preflight-result caching
Access-Control-Max-Age specifies how long a browser may reuse a preflight result. MDN documents a five-second default, a Firefox cap of 24 hours (86,400 seconds), and a Chromium cap of two hours (7,200 seconds) beginning with Chromium 76. These are documented browser defaults or caps, not a promise that every browser will cache for that duration; browsers may impose limits. A configuration change may not prompt a fresh preflight while the browser still has a usable result. Check the current MDN reference for Access-Control-Max-Age for updated behavior.
HTTP response caching and Vary: Origin
If a server chooses an explicit Access-Control-Allow-Origin according to the incoming Origin, add Vary: Origin to the relevant response so HTTP caches can distinguish variants. This is separate from the browser’s preflight cache: Access-Control-Max-Age does not replace Vary: Origin, and Vary: Origin does not clear a cached preflight result. Inspect the response headers delivered to the browser before concluding that an intermediary returned a stale or mismatched response.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why does the browser still show a CORS error after I changed the headers?
Work through the observable requests again rather than broadening access as a first response:
- Check whether the browser sent a new OPTIONS request or reused a preflight result.
- Confirm that the preflight permits the exact origin, requested method, and requested headers.
- Confirm that the actual response has the needed CORS headers, including an explicit origin and credentials permission when credentials are used.
- Inspect redirects, error responses, and whether middleware or infrastructure handles OPTIONS and the actual request differently.
- When origins receive different explicit allow-origin values, verify
Vary: Originand compare the responses seen through production. - Use a fresh browser context to test the server fix, then verify the returned headers in the Network panel.
Do not treat mode: "no-cors" as a general fix. It produces an opaque response that JavaScript cannot read. Simplifying a request can avoid preflight only if the method, headers, and content type genuinely meet the CORS safelist conditions. The right correction is a server policy that permits the application’s actual, necessary request—not a blanket relaxation. See MDN’s CORS guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
