Fix: No 'Access-Control-Allow-Origin' header is present

Your page on one origin (here http://localhost:5173) called an API on another (http://localhost:3001). A different port is enough to count as a different origin. The browser sent the request, got a response, and then refused to let your JavaScript read it, because the response didn’t say this origin was allowed.

That’s why Postman and curl work: CORS is a browser rule, not a server one. I called the same URL with Node’s fetch and got {"ok":true}.

In your code, every version of this error looks identical: TypeError: Failed to fetch. The details are only in the browser console. I got five different versions in Chrome:

The second and third rows involve a preflight: before a POST with a JSON body (or any custom header), the browser first sends an OPTIONS request asking for permission. If that answer is wrong, the real request is never sent.

One look-alike that isn’t CORS: with the API not running at all, fetch also threw Failed to fetch, but the console said net::ERR_CONNECTION_REFUSED and nothing about CORS.

Fix it on the API

npm i cors

import cors from 'cors';

app.use(cors());

The order of middleware matters

The last row of the table is the one that wastes the most time. My login check ran before cors() and answered 401. That response had no CORS headers, so the browser hid it, and the console reported a CORS problem instead of “not logged in”.

app.use(cors());
app.use(requireLogin);

Sending cookies: no wildcard

With credentials: 'include' in fetch, the browser refuses Access-Control-Allow-Origin: *. The server has to name your origin and allow credentials.

app.use(cors({ origin: 'http://localhost:5173', credentials: true }));

Not your API: proxy it in development

If you can’t change the server, or just want local development to work, let the Vite dev server forward the requests. The browser then only talks to its own origin, so CORS never comes up.

// vite.config.js
export default {
  server: {
    proxy: {
      '/api': {
        target: 'http://localhost:3001',
        rewrite: (path) => path.replace(/^\/api/, ''),
      },
    },
  },
};

What didn’t work

How this was tested

Windows 11 Pro, Node 24.14.0, October 19, 2026. An Express 5.3.0 API on port 3001 served the same routes with no CORS headers, with a hand-set *, with cors 2.8.6, with credentials allowed, and with a 401 check before and after cors(). A page on the Vite 8.3.4 dev server (port 5173) called each one with fetch in Chromium 152 (Claude’s built-in browser), then again through the Vite proxy. Every console message above is the real output.