python auth_error ai_generated true

starlette.middleware.cors.CORSMiddleware: Invalid CORS origin: 'https://example.com'

ID: python/starlette-multiple-cors-origins

Also available as: JSON · Markdown · 中文
80%Fix Rate
82%Confidence
0Evidence
2024-05-30First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.x active — — —

Root Cause

The CORS middleware is configured with a list of allowed origins, but the incoming request's Origin header is not in the list, causing rejection.

generic

中文

CORS中间件配置了允许的来源列表，但请求的Origin头不在列表中，导致被拒绝。

Workarounds

  1. 95% success 
    Add the exact origin to `allow_origins` list, or use a regex pattern with `allow_origin_regex`.
  2. 90% success 
    If credentials are needed, cannot use wildcard; use specific origins.

Dead Ends

Common approaches that don't work:

  1. 90% fail

    Adding the origin to the list after the request doesn't help because the middleware checks at request time.

  2. 85% fail

    Using wildcard `*` with credentials is not allowed in browsers, so it fails for credentialed requests.