Fix a CORS error in an AI-generated app: inspect the actual request boundary

A worked example: where the task becomes difficult

A fictional frontend at a preview domain calls an API configured only for the production origin. The browser blocks access even though a command-line request succeeds. Record scheme, host and port for both sides, plus request method and headers. The preview may require an approved origin entry, but it should not inherit broad access to unrelated endpoints or credentials.

Decisions to make before implementation

Distinguish network failure, authentication failure and cross-origin policy. The server might process a request even when the browser cannot read its response, so blind retries can duplicate side effects. Decide whether cookies or authorization are involved and inspect the preflight where applicable. Prefer a same-origin backend route when that matches the architecture; do not invent an open relay to avoid understanding the receiving service.

A practical sequence for the work

Use the sequence below as a task boundary, not as a claim that the example has been executed. Work with approved inputs and the project’s actual architecture. If a required integration or permission is unavailable, keep that stage visibly incomplete rather than generating a plausible substitute result.

• Record the exact origin pair and the browser’s failing request.
• Inspect preflight and actual response headers alongside server logs.
• Authorize only the intended origins, methods and credentials at the owning service.
• Retest the browser request and check whether any earlier attempt created an operation.

A detailed brief you can adapt for your agent

Replace the illustrative context with your approved facts and controlled inputs. Keep the stated boundaries when adapting the brief. The expected deliverable matters more than a particular tool name: ask for an explanation grounded in the inspected material and evidence for the requested outcome.

Investigate the cross-origin failure using this origin pair and request trace. Check preflight, actual response and receiver logs. Configure the narrow intended policy at the receiving boundary. Preserve authentication and reject unapproved origins. Do not add an unrestricted proxy or disable browser security. Verify duplicate side effects before retrying writes.

Failure modes that an attractive preview can hide

A wildcard policy is not a universal fix, especially for credentialed requests. Do not tell visitors to install a browser extension that bypasses protections. A missing CORS header on an error response can hide the underlying server failure; inspect the receiver before declaring that origin configuration is the only cause.

Technical references: MDN: Cross-Origin Resource Sharing

Acceptance checks and the evidence to retain

Document the origin policy, causal response failure and verified browser request. Keep authentication and authorization checks distinct from CORS configuration.

Specific answers

Common questions