Practical workflow

CORS error: why it works in Postman but not in the browser

CORS is a browser rule, not a server or network rule. Postman and curl do not apply it, so the same request works there but not from a web page.

Checkcraft · 6 November 2026

Get help with your first test →

What happens

A browser lets a page from one origin read responses from another origin only with that server’s permission. The permission is the Access-Control-Allow-Origin response header. If it is missing or names a different origin, the browser blocks the response and logs “has been blocked by CORS policy”. The request itself may still have reached the server and run.

The OPTIONS preflight

For requests with JSON, custom headers or PUT and DELETE methods, the browser first sends OPTIONS to ask for permission. The server must answer with a success code and the Access-Control-Allow-Origin, Access-Control-Allow-Methods and Access-Control-Allow-Headers headers. You can inspect the answer to such a request with curl.

curl -i -X OPTIONS https://api.example.com/orders \
  -H "Origin: https://app.example.com" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: content-type"

How to fix it

Configure the server: allow the exact frontend origin, the needed methods and headers. An asterisk in Access-Control-Allow-Origin does not work with cookies and credentialed requests; you need the exact origin then. For local development, a dev server proxy that calls the API on its own behalf is convenient. Turning off browser protection is a bad idea: you may miss a problem that breaks the live site.

How to test an API without a browser

It is easier to test the API itself where CORS does not interfere: curl, Postman or Checkcraft. To keep CORS from breaking after a release, add an OPTIONS request with an Origin header to your checks and a rule on Access-Control-Allow-Origin in the response.

Next step

Repeat this on your own API

Checkcraft is a desktop app that saves API response checks without code and shows what did not match. Start with a sample, then use your own sanitized data. Free runs on Windows and Linux with no time limit.

Download Free Download and first run

No sign-up or email needed, the archive is ready in a couple of minutes. See the edition limits.

References

MDN: CORS

Start with the linked example and compare its result with your own test requirement.