Fix this error

CORS: No 'Access-Control-Allow-Origin' header is present

Dasun Kalupahana Updated November 11, 2026 289 views

Error

Access to fetch at 'https://api.example.com/api/users' from origin 'https://app.example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Why it happens

The browser blocks a request from one origin (domain, port or protocol) to another unless the server allows it with CORS headers. In Laravel, the path is not in config/cors.php, the origin is not allowed, or the request fails before CORS headers are added (for example a 500 error).

How to fix it

Publish the config if you don't have it: php artisan config:publish cors.
Add the API paths and your front-end origin.
Sending cookies (Sanctum SPA)? Set supports_credentials to true and use exact origins, not *.
Clear the config cache and check the response in the browser's Network tab: a server error also shows up as a CORS error.

// config/cors.php
return [
    'paths' => ['api/*', 'sanctum/csrf-cookie'],
    'allowed_methods' => ['*'],
    'allowed_origins' => ['https://app.example.com'],
    'allowed_headers' => ['*'],
    'supports_credentials' => true,
];

#laravel #api #javascript

Still stuck? Send us the full error and what you tried. We add the answers here.