# Access to fetch at 'http://localhost:8000/api' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

- **ID:** `python/fastapi-cors-header-missing`
- **Domain:** python
- **Category:** network_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

CORSMiddleware is not installed or does not include the requesting origin, so the browser blocks the response.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (95% success)
   ```
   from fastapi.middleware.cors import CORSMiddleware
app.add_middleware(CORSMiddleware, allow_origins=['http://localhost:3000'], allow_credentials=True, allow_methods=['*'], allow_headers=['*'])
   ```
2. **** (88% success)
   ```
   app.add_middleware(CORSMiddleware, allow_origin_regex=r'https://.*\.example\.com')
   ```

## Dead Ends

- **** — Browsers reject wildcard origin when credentials are included. (90% fail)
- **** — Not possible for end users; only a local dev flag. (95% fail)