# CORS Error in Safari: No Access-Control-Allow-Origin Header on Response

**URL:** <https://forum.serverless.com/t/cors-error-in-safari-no-access-control-allow-origin-header-on-response/21141>\
**Category:** Serverless Framework\
**Tags:** lambda, cors, api-gateway\
**Created:** [April 17, 2025, 7:02am UTC](https://forum.serverless.com/t/cors-error-in-safari-no-access-control-allow-origin-header-on-response/21141 "2025-04-17T07:02:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![daay22](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@daay22](https://forum.serverless.com/u/daay22)\
**Post date:** [April 17, 2025, 7:02am UTC](https://forum.serverless.com/t/cors-error-in-safari-no-access-control-allow-origin-header-on-response/21141/1 "2025-04-17T07:02:34Z")

</div>

I am facing an issue where my backend API is returning a **CORS** error in **Safari** but works fine in **Chrome** and **Postman**. The specific error in Safari is:

Access to XMLHttpRequest at ‘[https://backendServer/users/login?email=email&password=password](https://backendServer/users/login?email=email&password=password)’  
from origin ‘[https://url](https://url)’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

When looking in the network tab, I see there is no Response headers.

I have configured **CORS** in my backend using the following middleware in

```auto
**Express.js** :
const cors = require('cors');

const corsOptions = {
  origin: process.env.WebPageUrl, // Allow only requests from this origin
  credentials: true, // Allow cookies to be sent with the requests
  allowedHeaders: ["Content-Type", "Authorization"], // Ensure headers are allowed
  methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"], // Specify allowed methods
};

const app = express();
app.use(cors(corsOptions)); // Apply CORS middleware

// Additional middleware for handling CORS preflight requests
app.options('*', cors(corsOptions)); // Handles OPTIONS pre-flight requests app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', process.env.WebPageUrl); // Allow only requests from this origin
  res.header('Access-Control-Allow-Credentials', 'true'); // Allow cookies
  res.header('Access-Control-Expose-Headers', 'Access-Control-Allow-Origin, Content-Type, Authorization'); // Expose specific headers
  res.setHeader('Cache-Control', 'no-store'); // Prevent caching
  next();
});

```

When setting the JWT cookie, I am using the following options:

```auto
const cookieOptions = {
  expires: new Date(Date.now() + process.env.JWT_COOKIE_EXPIRES_IN * 24 * 60 * 60 * 1000),
  httpOnly: true,
  sameSite: 'None', // For cross-origin requests
  secure: true // Cookies must be sent over HTTPS
};
res.cookie('jwt', token, cookieOptions);

```

On the frontend I’m using axios to do the following

```auto
 async login(credentials) {
        const url = `users/login`;

        const {email,password} = credentials;

        var response = "";
        await http
            .get(url, {
                params:{
                    email:email,
                    password:password
                },
                cache: false,
                withCredentials:true
            })
            .then(responseData => {
                console.log(responseData)
                response = responseData.data;
            })
            .catch(error => {
                response = error.response;
                throw new Error(`HTTP error! status: ${response.status}`);
            });

        return response;
    }

```

I have configured **CORS** in the **`serverless.yaml`** for my API:

```auto
functions:
  app:
    handler: server.handler
    events:
      - http:
          path: /api/v1/users/login
          method: GET
          cors:
            origin:
                - "https://url" # Web app
            allowCredentials: true
            headers:
                - Content-Type
                - Authorization

```

Kind of at a lose as to why this is failing

---

<div class="post-metadata">

**Author:** ![beenmeckel](https://avatars.discourse-cdn.com/v4/letter/b/8dc957/32.png) [@beenmeckel](https://forum.serverless.com/u/beenmeckel)\
**Post date:** [February 26, 2026, 9:40pm UTC](https://forum.serverless.com/t/cors-error-in-safari-no-access-control-allow-origin-header-on-response/21141/2 "2026-02-26T21:40:13Z")

</div>

The “No Access-Control-Allow-Origin Header on Response” error in Safari indicates a standard Cross-Origin Resource Sharing (CORS) issue, often highlighting stricter enforcement of the CORS policy by WebKit browsers (Safari for macOS/iOS, Chrome for iOS) compared to others.[snaptube](https://snaptube.cam/)[vidmate](https://vidmate.bid/)