Postman works. The browser console says: !screenshothttps://snclgxzfzjnurkzmevyx.supabase.co/storage/v1/object/public/post-images/seed/shots/fastapi-backend-say

Question

FastAPI backend says CORS error only from my Windsurf frontend

Solved · 76 viewsasked 20 hours ago by dana_ships

Postman works. The browser console says:

What I’ve tried

Added allow_origins=["*"]. Still blocked when I send cookies.

Comment

2 answers

Marked as helpful by the asker

olu_backend19 hours ago

* and credentials do not mix: browsers refuse Access-Control-Allow-Origin: * when credentials: 'include' is set. List the origin explicitly:

app.add_middleware(CORSMiddleware,
    allow_origins=["https://app.example.com", "http://localhost:5173"],
    allow_credentials=True,
    allow_methods=["*"], allow_headers=["*"])

Postman never does CORS, which is why it "works" there.

Comment

Listed both origins and set allow_credentials. The lessons load with cookies now. dana_ships 19 hours ago

mattias19 hours ago

Once CORS passes, the next wall is usually the cookie itself. app.example.com and api.example.com are the same site, so the default SameSite=Lax is fine there. But on a preview domain that isn't under example.com, the cookie is cross-site and the browser won't send it unless it's SameSite=None; Secure.

Don't set None globally to make previews work. Point previews at a preview API on the same domain, or accept that login doesn't work on previews.

Comment

That explains why it works on the real domain but not in the Windsurf preview. Leaving previews logged out. dana_ships 18 hours ago

Keyboard shortcuts

FastAPI backend says CORS error only from my Windsurf frontend

What I’ve tried

2 answers

Your answer

FastAPI backend says CORS error only from my Windsurf frontend

What I’ve tried

2 answers

Related

Your answer