# INTERNAL: grpc-web: CORS preflight failed for origin http://example.com: allowed origins: [http://localhost:3000]

- **ID:** `grpc/grpc-web-cors-origin-mismatch`
- **Domain:** grpc
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 92%

## Root Cause

The gRPC-Web proxy's CORS configuration does not include the requesting origin, causing the browser to block the preflight request and preventing the gRPC call from proceeding.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| gRPC-Web v1.4.0 | active | — | — |
| Envoy 1.27.0 | active | — | — |
| gRPC v1.60.0 | active | — | — |

## Workarounds

1. **Update the Envoy or gRPC-Web proxy configuration to include the requesting origin: in Envoy, add `allowed_origins: ["http://example.com"]` to the CORS filter.** (90% success)
   ```
   Update the Envoy or gRPC-Web proxy configuration to include the requesting origin: in Envoy, add `allowed_origins: ["http://example.com"]` to the CORS filter.
   ```
2. **Use a reverse proxy like Nginx to handle CORS headers: `add_header Access-Control-Allow-Origin "http://example.com" always;`** (85% success)
   ```
   Use a reverse proxy like Nginx to handle CORS headers: `add_header Access-Control-Allow-Origin "http://example.com" always;`
   ```
3. **Temporarily enable a wildcard origin for development: in Envoy config, set `allowed_origins: ["*"]` but revert for production.** (75% success)
   ```
   Temporarily enable a wildcard origin for development: in Envoy config, set `allowed_origins: ["*"]` but revert for production.
   ```

## Dead Ends

- **** — Disabling CORS entirely in the browser (e.g., using a flag) is insecure and not a production solution. (90% fail)
- **** — Changing the client origin in the browser's developer tools does not persist and is not a real fix. (80% fail)
- **** — Adding a wildcard '*' to allowed origins may work but exposes the service to any origin, creating security risks. (60% fail)