# CORS (/academy/cors)



**CORS** is your browser asking another origin if this page may call it.

Cross-Origin Resource Sharing. The name is worse than the rule. Your [frontend](/academy/frontend-backend) on `http://localhost:3000` asks `http://localhost:3001` for data. Those are two origins. The browser checks with the [API](/academy/api) first. If the API does not send the right headers, the tab hides the response. The [server](/academy/server) may have been fine. The browser is being a parent.

**The tell**

The same `fetch` from the [CLI](/academy/cli) or an [agent](/academy/agent) works. No browser, no check. If the terminal is green and the tab is red, it is almost always this.

This exists so a random site in one tab cannot quietly call your bank in another tab, riding a [cookie](/academy/cookie) you already have. The error sounds like you committed a crime. You did not. You crossed origins.

**Fix the side you own**

If the [builder](/builder) split frontend and backend, allow your real origins on the server: localhost in dev, the [deploy](/academy/deploy) URL in prod. Do not paste `*` next to credentials. A wildcard plus cookies is how you undo the protection.

If you do not own the other API, stop calling it from the browser. Route through your backend. Server to server has no CORS conversation. Judges will open the public URL, not your two-port laptop setup — allow that origin before you walk on stage.

**What this unlocks**

"Blocked by CORS policy" stops meaning "my app is illegal."

Allow the origins you mean. Or stop crossing the street from the tab.