Browser: Access to fetch at 'https://api.example.com/api/data' from origin 'https://app.example.com' has been blocked by CORS policy (Next.js route handler)
A cross-origin request to your Next.js API route is blocked because the response lacks CORS headers.
Access to fetch at 'https://api.example.com/api/data' has been blocked by CORS policy Next.js API routeNo 'Access-Control-Allow-Origin' header is present on the requested resource Next.js route handlerCORS preflight Next.js API route OPTIONSResponse to preflight request doesn't pass access control check Next.js Meaning
Next.js doesn't add CORS headers by default. Add them in the route handler (including an OPTIONS handler for preflight), via headers() in next.config.js, or in middleware. Never use * with credentials. Same-origin calls from your own pages don't need CORS.
Common causes
- No
Access-Control-Allow-Originheader - Missing OPTIONS handler for preflight
- Credentials with wildcard origin
- Middleware redirecting preflight
- Different origin domain/port
⚡ Quick fix
- Add headers in
next.config.jsheaders()for/api/:path* - Export
OPTIONSand return the CORS headers - Use specific origins instead of
*when sending cookies
Detailed fix by platform
Next.js
export async function OPTIONS() { return new Response(null, { status: 204, headers: { "Access-Control-Allow-Origin": "https://app.example.com", "Access-Control-Allow-Methods": "GET,POST,OPTIONS", "Access-Control-Allow-Headers": "Content-Type" } }); }
How to diagnose
- Origin — Allowed?
- Preflight — OPTIONS handled?
- Credentials — Wildcard conflict?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
- _next/image 400 / upstream image response failed Next.js: ⨯ upstream image response failed for https://example.com/a.jpg 404 / url parameter is not allowed
- 'sharp' is required to be installed in standalone mode Next.js: Error: 'sharp' is required to be installed in standalone mode for the image optimization to function correctly
- Conflicting app and page file was found Next.js: ⨯ Conflicting app and page file was found, please remove the conflicting files to continue: "pages/index.tsx" - "app/page.tsx"
Most viewed in Next.js
- NEXT_REDIRECT Next.js: Error: NEXT_REDIRECT (redirect() inside try/catch)
- server-only Next.js: You're importing a component that needs "server-only". That only works in a Server Component
- cookies() should be awaited Next.js 15: Route "/x" used `cookies().get('token')`. `cookies()` should be awaited before using its value
Other ways to find it
Where this error sits
Origin: On your device. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Report a correction or suggest an improvement
Last updated 5 Nov 2026