# starlette.middleware.cors.CORSMiddleware: Invalid CORS origin: 'https://example.com'

- **ID:** `python/starlette-multiple-cors-origins`
- **Domain:** python
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The CORS middleware is configured with a list of allowed origins, but the incoming request's Origin header is not in the list, causing rejection.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (95% success)
   ```
   Add the exact origin to `allow_origins` list, or use a regex pattern with `allow_origin_regex`.
   ```
2. **** (90% success)
   ```
   If credentials are needed, cannot use wildcard; use specific origins.
   ```

## Dead Ends

- **** — Adding the origin to the list after the request doesn't help because the middleware checks at request time. (90% fail)
- **** — Using wildcard `*` with credentials is not allowed in browsers, so it fails for credentialed requests. (85% fail)