{"record":{"id":"a80ba6ffe598e61f","repo":"gchq/CyberChef","slug":"error-null-response-try-setting-the-connection-m","errorCode":null,"errorMessage":"Error: Null response. Try setting the connection mode to CORS.","messagePattern":"Error: Null response\\. Try setting the connection mode to CORS\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"warning","filePath":"src/core/operations/HTTPRequest.mjs","lineNumber":109,"sourceCode":"\n            headers.set(split[0].trim(), split[1].trim());\n        });\n\n        const config = {\n            method: method,\n            headers: headers,\n            mode: modeLookup[mode],\n            cache: \"no-cache\",\n        };\n\n        if (method !== \"GET\" && method !== \"HEAD\") {\n            config.body = input;\n        }\n\n        return fetch(url, config)\n            .then(r => {\n                if (r.status === 0 && r.type === \"opaque\") {\n                    throw new OperationError(\"Error: Null response. Try setting the connection mode to CORS.\");\n                }\n\n                if (showResponseMetadata) {\n                    let headers = \"\";\n                    for (const pair of r.headers.entries()) {\n                        headers += \"    \" + pair[0] + \": \" + pair[1] + \"\\n\";\n                    }\n                    return r.text().then(b => {\n                        return \"####\\n  Status: \" + r.status + \" \" + r.statusText +\n                            \"\\n  Exposed headers:\\n\" + headers + \"####\\n\\n\" + b;\n                    });\n                }\n                return r.text();\n            })\n            .catch(e => {\n                throw new OperationError(e.toString() +\n                    \"\\n\\nThis error could be caused by one of the following:\\n\" +\n                    \" - An invalid URL\\n\" +","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/HTTPRequest.mjs#L91-L127","documentation":"Thrown by HTTP Request when the Fetch API returns a response whose status is 0 and type is 'opaque'. That happens when the request was made in 'No CORS' mode (modeLookup maps to 'no-cors'); the browser delivers an empty, unreadable response. CyberChef cannot read the body in that mode, so it tells the user to switch to CORS mode.","triggerScenarios":"Selecting 'No CORS (limited to HEAD, GET or POST)' as the Connection mode argument against any URL; cross-origin request where CORS is not allowed and the user picked no-cors to avoid a hard failure.","commonSituations":"Defaulting to no-cors to silence browser errors; calling an API that does not send Access-Control-Allow-Origin; misunderstanding that no-cors still forbids reading the response body from JS.","solutions":["Change the Connection mode argument to 'Cross-Origin Resource Sharing' (CORS).","Ensure the target server returns Access-Control-Allow-Origin matching the CyberChef origin.","Run CyberChef from the same origin as the target, or proxy the request.","If the API genuinely lacks CORS, fetch it outside the browser (curl, a server-side tool)."],"exampleFix":"// before\nconst args = [\"GET\", url, headers, \"No CORS (limited to HEAD, GET or POST)\", false];\n// after\nconst args = [\"GET\", url, headers, \"Cross-Origin Resource Sharing\", false];","handlingStrategy":"validation","validationCode":"// Pick a Connection mode that returns a readable response\nconst mode = targetAllowsCors ? 'Cross-Origin Resource Sharing' : null;\nif (mode === null) {\n  throw new Error('Target has no CORS; fetch it outside the browser instead');\n}","typeGuard":"function isReadableMode(mode) {\n  // only CORS mode yields a readable response from cross-origin in-browser\n  return mode === 'Cross-Origin Resource Sharing';\n}","tryCatchPattern":"try {\n  result = await httpReq.run(url, [method, url, headers, mode, showMeta]);\n} catch (e) {\n  if (e instanceof OperationError && /Null response/.test(e.message)) {\n    result = await httpReq.run(url, [method, url, headers, 'Cross-Origin Resource Sharing', showMeta]);\n  } else throw e;\n}","preventionTips":["Default the Connection mode to CORS unless you have a specific reason for no-cors.","Confirm the server returns Access-Control-Allow-Origin before using no-cors.","Remember no-cors forbids reading the body from JavaScript."],"tags":["http","fetch","cors","cross-origin","browser"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}