"No 'Access-Control-Allow-Origin' header" — what to do

What it means

Your request reached the server and got a response, but that response carried no Access-Control-Allow-Origin header, so the browser refused to hand it to your JavaScript. This is the variant that means CORS is not configured at all, rather than configured wrongly.

Why it happens in AI-built apps

• The API has no CORS middleware — common when the backend was generated separately from the frontend.
• An error response (500, 404) skipped the middleware that would have added the header, so only failures look broken.
• A proxy or CDN strips the header before it reaches the browser.
• The route is served by a framework default handler that does not run your middleware.

Is this error actually a problem?

Check it yourself

# a route that works
curl -sI https://YOUR-API.com/ok -H "Origin: https://yourapp.com" | grep -i access-control

# a route that 404s — if the header is missing only here, your error path
# skips the CORS middleware and the real bug is the 404
curl -sI https://YOUR-API.com/does-not-exist -H "Origin: https://yourapp.com" | grep -i access-control

Fix it

My API responses have no Access-Control-Allow-Origin header.

1. Show me where CORS is configured and whether that code runs for every
   route, including error responses and 404s.
2. Check whether the failing response is actually a 5xx or 404 being
   reported as a CORS problem — if so, fix that first and tell me what it
   was.
3. Configure CORS with an explicit list of my own origins, applied to all
   responses including errors.
4. Confirm no proxy or CDN in front of the app strips the header.

Do not use a wildcard origin. Tell me which origins are allowed after
the change.