Direct answer

The browser received a response that does not authorize the requesting Origin. Inspect both OPTIONS and the actual response rather than adding a wildcard header everywhere.

Where this error appears

Browser fetch, XMLHttpRequest, fonts, modules, and API gateways

Root cause

The route, preflight handler, redirect target, proxy error page, or credential policy may omit or return an incompatible Access-Control-Allow-Origin value.

Minimal reproduction

CORS
Access to fetch at 'https://api.example.com' from origin 'https://app.example.com' has been blocked by CORS policy

Corrected example

FIXED
Allow only the intended Origin and methods at the API or gateway, handle OPTIONS before authentication when appropriate, and return consistent CORS headers on errors and final responses.

Verify the fix

TERMINAL
Check OPTIONS and the actual method with the HTTP / CORS Checker using the exact browser Origin.

Things to check

  • CORS protects browsers; curl succeeding does not prove browser access.
  • Do not combine credentials with Access-Control-Allow-Origin: *.
  • Review redirects because the final response may use different policy.