# CORS/HEADERS error fetching data

**URL:** <https://forum.serverless.com/t/cors-headers-error-fetching-data/4097>\
**Category:** Serverless Framework\
**Tags:** aws, lambda\
**Created:** [March 27, 2018, 6:16am UTC](https://forum.serverless.com/t/cors-headers-error-fetching-data/4097 "2018-03-27T06:16:34Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![fandridis](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/fandridis/32/1782_2.png) [@fandridis](https://forum.serverless.com/u/fandridis)\
**Post date:** [March 27, 2018, 6:16am UTC](https://forum.serverless.com/t/cors-headers-error-fetching-data/4097/1 "2018-03-27T06:16:34Z")

</div>

Hey guys! I am trying to make an API call from a simple Vue app in S3 or just localhost and I get this error:

Failed to load … : No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘[http://localhost:3000](http://localhost:3000)’ is therefore not allowed access. The response had HTTP status code 403.

**My serverless.yml:**  
getAll:  
handler: handler.getAll # path will be [domain.name.com/dev/notes](http://domain.name.com/dev/notes)  
events:  
- http:  
path: notes  
method: get  
cors: true

And handler.js:  
module.exports.create = (event, context, callback) =\> {  
context.callbackWaitsForEmptyEventLoop = false;

```
  connectToDatabase()
    .then(() => {
      Note.create(JSON.parse(event.body))
        .then(note => callback(null, {
          statusCode: 200,
          headers: { 
            'Access-Control-Allow-Origin': '*', // Required for CORS support to work
            'Access-Control-Allow-Credentials': true, // Required for cookies, authorization headers with HTTPS
          },
          body: JSON.stringify(note)
        }))
        .catch(err => callback(null, {
          statusCode: err.statusCode || 500,
          headers: { 
            'Access-Control-Allow-Origin': '*', // Required for CORS support to work
            'Access-Control-Allow-Credentials': true, // Required for cookies, authorization headers with HTTPS
          },
          body: 'Could not create the note.'
        }));
    });
};

```

It works on POSTMAN and from aws direct link, but not on website/localhost. Tried to follow other conversations about setting the header, but didn’t make it work. Any ideas? Thanks!