"No 'Access-Control-Allow-Origin' header is present" — what it means and how to fix it
If you've hit this error in your browser console, your request technically worked — the server responded — but your browser refused to hand you the response:
Here's what it means, why your browser is doing this on purpose, and how to actually fix it.
1What this error actually means
This error is triggered by Cross-Origin Resource Sharing (CORS), which is a browser safety rule. When JavaScript running on website A (https://site-a.com) tries to fetch data from site B (https://api-b.com), the browser blocks the response by default. To allow this access, the server (site B) must explicitly return response headers saying: "Yes, site A is allowed to read my data." If those headers are missing, the browser blocks the response and displays this error.
2Why your browser is doing this on purpose
Browsers enforce the Same-Origin Policy (SOP) to protect users. Without it, if you visited a malicious website in another tab, scripts on that site could silently send requests to your bank website, email portal, or social accounts using your active session cookies, stealing your personal information. CORS acts as a controlled gateway, letting servers explicitly state which origins are trusted.
3Other CORS errors you might see
"Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request."Meaning: For complex requests (like JSON bodies or custom headers), the browser sends a preflight OPTIONS request first. The server failed to respond successfully to that check.
4How to fix it (server-side)
Since CORS is client-side validation, you cannot bypass it in standard browsers without server authorization. To resolve CORS issues, you must configure your server or API gateway to return these HTTP headers in responses:
Access-Control-Allow-Origin: * on endpoints that handle authenticated requests (cookies, auth tokens, sessions). Browsers block wildcard origins from being used with credentialed requests, and using * in production on sensitive endpoints is a security risk. Specify exact allowed origins instead, e.g. Access-Control-Allow-Origin: https://yourtrustedapp.com.5Why Our API Tester Shows a Warning
Unlike server-side tools like Postman, Quietbench's API Tester runs 100% in your local browser client-side. This guarantees your sensitive request data is never sent to a third-party server. However, it also means your browser's standard CORS restrictions apply. If you attempt to query a server that does not return CORS header credentials, the browser blocks the response. To bypass this for testing, enable CORS headers on your server or test using a browser extension that temporarily disables CORS checks.
Ready to test your API endpoints?
Send HTTP requests, customize payload headers, and inspect response status and bodies directly from your browser.