CORS basics for APIs hosted on Schokr

If your browser console says a request was "blocked by CORS policy", your API on Schokr needs to allow requests from the website that calls it. CORS is enforced by browsers, so the fix is always on the API side: send the right Access-Control-Allow-Origin header.

When CORS applies

An "origin" is scheme, host and port together. These are all different origins:

https://mysite.example
http://mysite.example
http://<server-address>:25571

If a page on one origin uses fetch to call another, the browser checks the API's CORS headers. Server-to-server calls, bots, curl and Postman ignore CORS entirely. That is why your API "works in Postman but not in the browser".

Express

npm install cors

const cors = require('cors')

app.use(cors({
  origin: ['https://mysite.example', 'http://localhost:5173'],
  credentials: true,
}))

Fastify

import cors from '@fastify/cors'
await app.register(cors, { origin: ['https://mysite.example'] })

Hono

import { cors } from 'hono/cors'
app.use('/api/*', cors({ origin: ['https://mysite.example'] }))

Flask

flask-cors==5.0.0

from flask_cors import CORS
CORS(app, origins=["https://mysite.example"])

FastAPI

from fastapi.middleware.cors import CORSMiddleware

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://mysite.example"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

Common mistakes

Mistake	Result
`origin: '*'` together with credentials (cookies)	Browsers reject it; list exact origins instead
Trailing slash in the origin (`https://mysite.example/`)	No match; origins never have a path
CORS middleware added after routes	Some frameworks never send the headers; add it first
API crashes with 500	Error responses often lack CORS headers, so the browser shows a CORS error that hides the real one; check your console logs
Preflight `OPTIONS` request gets 404	Let the CORS middleware handle `OPTIONS` before auth or routing

Mixed content is not CORS

If your website is on https:// and your API is on plain http://<server-address>:<port>, the browser blocks the request as mixed content before CORS even matters. Schokr has no built-in HTTPS, so you need HTTPS in front of the API. See using your own domain. Alternatively, serve the website and API from the same Schokr app so they share one origin.

Is allowing every origin safe?

For a public, read-only API with no cookies, * is fine. For anything using cookies or sessions, list your exact origins. CORS is not authentication: it only controls browsers. Protect private endpoints with tokens or sessions as well.