CORS error calling Next.js API route / route handler Next.js Origin: On your device OSI layer 7 · Application Last updated 5 Nov 2026

Browser: Access to fetch at 'https://api.example.com/api/data' from origin 'https://app.example.com' has been blocked by CORS policy (Next.js route handler)

A cross-origin request to your Next.js API route is blocked because the response lacks CORS headers.

Exact message you may see Access to fetch at 'https://api.example.com/api/data' has been blocked by CORS policy Next.js API routeNo 'Access-Control-Allow-Origin' header is present on the requested resource Next.js route handlerCORS preflight Next.js API route OPTIONSResponse to preflight request doesn't pass access control check Next.js
Seen on: Next.js JavaScript

Meaning

Next.js doesn't add CORS headers by default. Add them in the route handler (including an OPTIONS handler for preflight), via headers() in next.config.js, or in middleware. Never use * with credentials. Same-origin calls from your own pages don't need CORS.

Common causes

  • No Access-Control-Allow-Origin header
  • Missing OPTIONS handler for preflight
  • Credentials with wildcard origin
  • Middleware redirecting preflight
  • Different origin domain/port

⚡ Quick fix

  1. Add headers in next.config.js headers() for /api/:path*
  2. Export OPTIONS and return the CORS headers
  3. Use specific origins instead of * when sending cookies

Detailed fix by platform

Next.js

  1. export async function OPTIONS() { return new Response(null, { status: 204, headers: { "Access-Control-Allow-Origin": "https://app.example.com", "Access-Control-Allow-Methods": "GET,POST,OPTIONS", "Access-Control-Allow-Headers": "Content-Type" } }); }

How to diagnose

  1. Origin — Allowed?
  2. Preflight — OPTIONS handled?
  3. Credentials — Wildcard conflict?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: On your device. Errors that are often confused with or caused by this one (click to open):

_next/image 400 / upstream image response failed — Next.js: ⨯ upstream image response failed for https://example.com/a.jpg 404 / url parameter is not allowed (Next.js)_next/image 400 / ups…'sharp' is required to be installed in standalone mode — Next.js: Error: 'sharp' is required to be installed in standalone mode for the image optimization to function correctly (Next.js)'sharp' is required t…Conflicting app and page file was found — Next.js: ⨯ Conflicting app and page file was found, please remove the conflicting files to continue: "pages/index.tsx" - "app/page.tsx" (Next.js)Conflicting app and p…CORS blocked (Laravel API) — Browser: Access to XMLHttpRequest at 'https://api.example.com' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header — Laravel (Laravel)CORS blocked (Laravel…CORS blocked in Rails API (rack-cors) — Browser: Access to fetch at 'http://localhost:3000/api/items' from origin 'http://localhost:5173' has been blocked by CORS policy — Rails (Ruby / Rails)CORS blocked in Rails…createContext only works in Client Components — Next.js: You're importing a component that needs createContext. It only works in a Client Component but none of its parents are marked with "use client" (Next.js)createContext only wo…ERESOLVE: next requires react ^18 (peer dependency conflict) — npm: ERESOLVE unable to resolve dependency tree — Found: react@19.0.0 / Could not resolve dependency: peer react@"^18.2.0" from some-lib (Next.js)ERESOLVE: next requir…ERR_TOO_MANY_REDIRECTS (Next.js middleware) — Browser: This page isn't working — redirected you too many times (ERR_TOO_MANY_REDIRECTS) with Next.js middleware / trailing slash (Next.js)ERR_TOO_MANY_REDIRECT…CORS erro…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.