{"record":{"id":"e46e3bfa7398d4b0","repo":"sveltejs/kit","slug":"cors-error-acao-incorrect-no-access-c","errorCode":null,"errorMessage":"CORS error: ${acao ? 'Incorrect' : 'No'} 'Access-Control-Allow-Origin' header is present on the requested resource","messagePattern":"CORS error: (.+?) 'Access-Control-Allow-Origin' header is present on the requested resource","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/kit/src/runtime/server/page/load_data.js","lineNumber":304,"sourceCode":"\n\t\tif (same_origin) {\n\t\t\tif (prerendering) {\n\t\t\t\tdependency = { response, body: null };\n\t\t\t\tprerendering.dependencies.set(url.pathname, dependency);\n\t\t\t}\n\t\t} else if (url.protocol === 'https:' || url.protocol === 'http:') {\n\t\t\t// simulate CORS errors and \"no access to body in no-cors mode\" server-side for consistency with client-side behaviour\n\t\t\tconst mode = input instanceof Request ? input.mode : (init?.mode ?? 'cors');\n\t\t\tif (mode === 'no-cors') {\n\t\t\t\tresponse = new Response('', {\n\t\t\t\t\tstatus: response.status,\n\t\t\t\t\tstatusText: response.statusText,\n\t\t\t\t\theaders: response.headers\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\tconst acao = response.headers.get('access-control-allow-origin');\n\t\t\t\tif (!acao || (acao !== event.url.origin && acao !== '*')) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`CORS error: ${\n\t\t\t\t\t\t\tacao ? 'Incorrect' : 'No'\n\t\t\t\t\t\t} 'Access-Control-Allow-Origin' header is present on the requested resource`\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t/** @type {ReadableStream<Uint8Array>} */\n\t\tlet teed_body;\n\n\t\tconst proxy = new Proxy(response, {\n\t\t\tget(response, key, receiver) {\n\t\t\t\t/**\n\t\t\t\t * @param {string | undefined} body\n\t\t\t\t * @param {boolean} is_b64\n\t\t\t\t */\n\t\t\t\tasync function push_fetched(body, is_b64) {","sourceCodeStart":286,"sourceCodeEnd":322,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/server/page/load_data.js#L286-L322","documentation":"When a universal `fetch` inside `load` targets a different origin, SvelteKit requires the response to carry a valid `Access-Control-Allow-Origin` header (matching the requesting origin or `*`). Missing or mismatched header means the client-side fetch would be blocked by the browser, so the server-side passthrough throws early with this descriptive error.","triggerScenarios":"Calling `fetch('https://api.other.com/...')` in a universal `+page.js` load where the API returns no `access-control-allow-origin` header, or one that doesn't match the current origin and isn't `*`.","commonSituations":"Third-party APIs without CORS support; API configured with a wrong origin (e.g. localhost:3000 vs localhost:5173); CDN/proxy stripping CORS headers; dev-to-prod origin mismatches.","solutions":["Configure the remote API to send `Access-Control-Allow-Origin: <your origin>` or `*`","Proxy the request through your own SvelteKit `+server.js` endpoint (same-origin, no CORS needed)","Fetch in a server-only `+page.server.js` load, where this CORS requirement doesn't apply"],"exampleFix":"// before (universal load, direct third-party fetch)\nconst res = await fetch('https://api.example.com/data');\n// after (proxy via local endpoint)\nconst res = await fetch('/api/data'); // +server.js proxies to https://api.example.com/data","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const res = await fetch('https://api.example.com/data');\n  if (!res.ok) throw new Error(`API error: ${res.status}`);\n  return { data: await res.json() };\n} catch (e) {\n  if (String(e).includes('CORS')) {\n    // fall back to server-side proxy\n  }\n  return { data: null };\n}","preventionTips":["Check CORS headers of third-party APIs before fetching them in universal loads","Prefer proxying external APIs through your own +server.js endpoints","Ensure dev and prod origins are both allowed by the remote API"],"tags":["cors","network","fetch","sveltekit"],"backgroundTag":"cors-allow-origin-missing","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}