gchq/CyberChef · warning · OperationError

Error: Null response. Try setting the connection mode to COR

Error message

Error: Null response. Try setting the connection mode to CORS.

What it means

Thrown by HTTP Request when the Fetch API returns a response whose status is 0 and type is 'opaque'. That happens when the request was made in 'No CORS' mode (modeLookup maps to 'no-cors'); the browser delivers an empty, unreadable response. CyberChef cannot read the body in that mode, so it tells the user to switch to CORS mode.

Source

Thrown at src/core/operations/HTTPRequest.mjs:109

            headers.set(split[0].trim(), split[1].trim());
        });

        const config = {
            method: method,
            headers: headers,
            mode: modeLookup[mode],
            cache: "no-cache",
        };

        if (method !== "GET" && method !== "HEAD") {
            config.body = input;
        }

        return fetch(url, config)
            .then(r => {
                if (r.status === 0 && r.type === "opaque") {
                    throw new OperationError("Error: Null response. Try setting the connection mode to CORS.");
                }

                if (showResponseMetadata) {
                    let headers = "";
                    for (const pair of r.headers.entries()) {
                        headers += "    " + pair[0] + ": " + pair[1] + "\n";
                    }
                    return r.text().then(b => {
                        return "####\n  Status: " + r.status + " " + r.statusText +
                            "\n  Exposed headers:\n" + headers + "####\n\n" + b;
                    });
                }
                return r.text();
            })
            .catch(e => {
                throw new OperationError(e.toString() +
                    "\n\nThis error could be caused by one of the following:\n" +
                    " - An invalid URL\n" +

View on GitHub (pinned to 4290ea7539)

Solutions

1. Change the Connection mode argument to 'Cross-Origin Resource Sharing' (CORS).
2. Ensure the target server returns Access-Control-Allow-Origin matching the CyberChef origin.
3. Run CyberChef from the same origin as the target, or proxy the request.
4. If the API genuinely lacks CORS, fetch it outside the browser (curl, a server-side tool).

Example fix

// before
const args = ["GET", url, headers, "No CORS (limited to HEAD, GET or POST)", false];
// after
const args = ["GET", url, headers, "Cross-Origin Resource Sharing", false];

// Pick a Connection mode that returns a readable response
const mode = targetAllowsCors ? 'Cross-Origin Resource Sharing' : null;
if (mode === null) {
  throw new Error('Target has no CORS; fetch it outside the browser instead');
}

function isReadableMode(mode) {
  // only CORS mode yields a readable response from cross-origin in-browser
  return mode === 'Cross-Origin Resource Sharing';
}

try {
  result = await httpReq.run(url, [method, url, headers, mode, showMeta]);
} catch (e) {
  if (e instanceof OperationError && /Null response/.test(e.message)) {
    result = await httpReq.run(url, [method, url, headers, 'Cross-Origin Resource Sharing', showMeta]);
  } else throw e;
}

When it happens

Trigger: Selecting 'No CORS (limited to HEAD, GET or POST)' as the Connection mode argument against any URL; cross-origin request where CORS is not allowed and the user picked no-cors to avoid a hard failure.

Common situations: Defaulting to no-cors to silence browser errors; calling an API that does not send Access-Control-Allow-Origin; misunderstanding that no-cors still forbids reading the response body from JS.

Related errors

• ${e.toString()}\n\nThis error could be caused by one of the
• Error making request to ${url} ${e.toString()}
• Error performing OCR on image. (${err})

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/a80ba6ffe598e61f. Report an issue: GitHub.