CORS Error Debugging Prompt
Debug a CORS error from the exact browser message, origins, preflight exchange, server stack, proxy path, credentials mode, and response headers.
Prompt Template
You are a senior web engineer helping me diagnose a Cross-Origin Resource Sharing (CORS) failure from evidence. First distinguish a browser-enforced CORS problem from DNS, TLS, proxy, authentication, application, network, or server errors that merely appear nearby. Use the exact browser message, request and response details, deployment path, framework versions, and current official documentation supplied by me or available to you. Never invent headers, middleware, routes, proxy behavior, framework APIs, versions, or successful results. Do not recommend disabling browser security, installing a bypass extension, using `mode: no-cors` as a fix, reflecting arbitrary origins, or combining wildcard origins with credentialed requests. User action and expected request: [details] Frontend page origin: [scheme, host, port] Request URL and API origin: [scheme, host, port, sanitized path] Browser and exact console error: [paste] Request method, relevant headers, content type, and credentials mode: [details] OPTIONS preflight request and response status and headers: [paste sanitized capture or none] Actual response status and headers: [paste sanitized capture or none] Frontend code making the request: [minimal reproducible snippet] Server language, framework, CORS middleware, routes, and exact versions: [details] Reverse proxy, gateway, CDN, load balancer, serverless platform, and cache path: [details] Allowed origins, methods, headers, credentials, and environment configuration: [verified values] Local, preview, staging, and production differences: [details] Recent changes and checks already tried: [details] Security constraints and secrets removed: [details] Provide: 1. A concise explanation of which origin tuple differs and whether a preflight is required. 2. An evidence table separating confirmed facts, likely causes, missing facts, and unrelated errors. 3. A request-flow trace from browser through every proxy layer to the application and back. 4. Read-only reproduction and inspection steps using browser network tools and safe commands. 5. A ranked root-cause list tied to observed status codes and headers. 6. The smallest framework- and version-correct server or proxy fix, with an explicit allowlist and environment handling. 7. Frontend changes only when the frontend is actually wrong; do not hide a server-policy failure. 8. Verification for simple requests, preflighted requests, credential behavior, allowed and denied origins, errors, and cache variation. 9. Security checks for origin reflection, credentials, exposed headers, private-network access, redirects, and shared caches. 10. Rollback steps and remaining unknowns. Redact cookies, authorization values, tokens, private hostnames, and personal data from all evidence.
Example Output
Diagnosis
The page origin is `[frontend origin]` and the API origin is `[API origin]`, so the browser applies CORS. The OPTIONS request reaches the proxy but its response lacks an origin-specific allow header; the application request is therefore never sent.
Minimal Fix
Configure the server or proxy layer that answers OPTIONS to allow only `[frontend origin]`, the required method, and the explicitly requested headers. If cookies are required, return that exact origin plus the appropriate credentials header and add origin-aware cache variation; do not use a wildcard.
Verify
1. Repeat OPTIONS and inspect status plus allow-origin, methods, headers, credentials, and cache headers.
2. Confirm the actual request follows and succeeds.
3. Send the same request from `[unapproved origin]` and confirm it is rejected.
4. Test both an application error and a success response because CORS headers must survive error paths.
Do not disable browser security or use `no-cors`; both conceal the policy failure.
Tips for Best Results
- 💡Paste the complete console message and sanitized OPTIONS exchange; the missing header is often on the preflight or error response, not the success path.
- 💡List every proxy and cache layer because one of them may answer OPTIONS or strip headers before the application sees the request.
- 💡Test an unapproved origin as well as the allowed one so the fix restores access without opening the API to arbitrary sites.
Frequently Asked Questions
What is the CORS Error Debugging Prompt prompt?
Debug a CORS error from the exact browser message, origins, preflight exchange, server stack, proxy path, credentials mode, and response headers. It's a free ChatGPT prompt template from our Coding collection — copy it, fill in the bracketed variables, and paste it into your AI tool.
Which AI tools work with this prompt?
It's written and tested for ChatGPT, Claude and Gemini. Any AI assistant that accepts free-form text prompts will handle it well.
How do I customize this ChatGPT prompt?
Replace the bracketed variables — such as [details], [scheme, host, port], [scheme, host, port, sanitized path] — with your own details before running it. Paste the complete console message and sanitized OPTIONS exchange; the missing header is often on the preflight or error response, not the success path.
Is this prompt free to use?
Yes. Every prompt on PromptAtlas is free to copy, customize, and use — no signup required.
Related Prompts
Python FileNotFoundError Debugging Prompt
Debug Python FileNotFoundError from the exact traceback, resolved path, working directory, filesystem context, deployment environment, and failing operation.
Python ZeroDivisionError Debugging Prompt
Debug Python ZeroDivisionError from the exact traceback, operand values and types, data path, numeric semantics, runtime context, and failing input.
Python IndentationError Debugging Prompt
Debug Python IndentationError from the exact parser message, whitespace, block structure, source bytes, formatter settings, and runtime version.
Python SyntaxError: Invalid Syntax Debugging Prompt
Debug Python SyntaxError invalid syntax from the exact parser location, surrounding tokens, Python version, generated code, execution context, and minimal reproduction.
Python AttributeError: Object Has No Attribute Debugging Prompt
Debug Python AttributeError from the exact traceback, runtime object type, attribute contract, construction path, version, imports, and minimal reproduction.
Python UnboundLocalError Debugging Prompt
Debug Python UnboundLocalError from the exact traceback, binding scope, assignments, branches, closures, imports, runtime path, and minimal reproduction.