Access to fetch at ‘https://api.tyretrackerpro.com/api/tyres’ from origin ‘https://app.tyretrackerpro.com’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. If an opaque response serves your needs, set the request’s mode to ‘no-cors’ to fetch the resource with CORS disabled.Understand this error
A CORS error occurs when a web application (client-side) makes a request to a server from a different origin, and the server does not include the necessary CORS headers in its response. This is primarily a server-side configuration issue, but the error appears in the browser due to security restrictions. To resolve it, you need to configure the server to send the appropriate CORS headers (like Access-Control-Allow-Origin) that permit the requesting origin."
CORS is a Browser Security Mechanism, the browser enforces CORS to prevent malicious websites from making unauthorized requests to other domains.
If the server does not explicitly allow the requesting origin (via HTTP headers), the browser blocks the response.
Server Must Send Proper CORS Headers
The server must include headers like:
Access-Control-Allow-Origin: * (allows all domains)
Access-Control-Allow-Origin: https://yourdomain.com (allows a specific domain)
Access-Control-Allow-Methods: GET, POST, PUT (specifies allowed HTTP methods)
Access-Control-Allow-Headers: Content-Type, Authorization (specifies allowed request headers)
Same here from Malaysia. We notice if we VPN to other countries outside of Malaysia, it works normal, else it returns the same static header response which is not ours. Further investigation founds that the request did not even reach our origin server. Suspect something wrong with cloudflare malaysia gateway that returning wrong cache response header to browsers.
I realized this just started happening today on all my domain and subdomains. I did not make any change to my servers across all my subdomains. I now suddenly get the same CORS OPTIONS response:
access-control-allow-headers: Content-Type // Not ours
access-control-allow-methods: POST,OPTIONS // not ours
This CORS issue is happening to us as well. In our case, our Access-Control-Allow-Headers is being set to “Content-Type” when it should be “authorization,content-type”. This is only happening on some devices but not others. We can confirm that turning off proxy fixes the problem. This problem happens even without us setting any response header transform rules in Cloudflare.
Can anyone from Cloudflare clarify what’s going on?
This answer applies if origin server does not setup CORS properly. The MAIN ISSUE is some of CF servers are not honoring origin’s CORS, especially the Access-Control-Allow-Headers which is causing preflight OPTIONS CORS on user’s browser. This is already happening for over 2 weeks.