You call your API from the frontend and the console shows:

Access to fetch at 'https://api.example.com/data' from origin 'http://localhost:5173' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Enter fullscreen mode

Exit fullscreen mode

The request often reached your server and succeeded . The browser just refused to hand the response to your JavaScript. CORS is enforced by the browser, so the fix almost always lives on the server , not in the fetch call.

Step 1: Is it a preflight?

The browser sends an OPTIONS request first if any of these are true:

the method isn't GET, HEAD or POST

you send Content-Type: application/json (yes, really)

you send custom headers such as Authorization

Open DevTools > Network, tick "All", and look for an OPTIONS request.…