Getting this error: has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No

[hrishikesh]

If you need further clues, you should be looking for help in:

@hrishikesh

2. Where to fix it?

Often times you’d think this is a Netlify issue because the error appears on your Netlify site. But, in a lot of cases, the issue is not on Netlify’s end. It’s important to understand that CORS needs to be configured on the server that’s serving the request. So if Netlify is not the server that’s serving the address you’re requesting, this is something you need to fix on the server serving the request. However, you can still fix this from Netlify’s end, as discussed further in this guide.

and

@hrishikesh

3.1: Assets not hosted on Netlify:

Continuing the discussion from point 2 above, where you have assets and APIs hosted on a different server than your Netlify-hosted frontend, you can solve such issues by using Netlify Rewrites . Please note, this method should only be used when you don’t control the other server or cannot add CORS headers there. If you can, the real solution would be to add the correct headers there.

Consider this situation:

• You have a Netlify-hosted site.
• That site is trying to connect to an API or an asset hosted on https://www.example.com/ which is not hosted by Netlify.

If this situation matches yours, you can add a netlify.toml in your project with the following data:

[[redirects]]
  force = true
  from = "/scripts/x.js"
  status = 200
  to = "https://www.example.com/scripts/x.js"

Now, in your frontend, you can make a request like: /scripts/x.js and Netlify will proxy that to https://www.example.com/scripts/x.js and return the response. Note that, the exact redirect that you’d need to setup would differ based on your requirement. Please refer to Netlify Rewrites documentation on various options and ways you can send such a request.

The reason this works to handle CORS is because, when you make a request like /external/api/, browsers treat it as a same-origin request and allow it.