# CORS issues on localhost **URL:** \ **Category:** Get Help\ **Tags:** localhost, cors\ **Created:** [May 21, 2021, 1:21am UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137 "2021-05-21T01:21:50Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![dave6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dave6/32/26439_2.png) [@dave6](https://community.auth0.com/u/dave6)\ **Post date:** [May 21, 2021, 1:21am UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/1 "2021-05-21T01:21:50Z")
I keep getting the following error when trying to update a user’s information using the following tutorial: [https://auth0.com/docs/users/update-root-attributes-for-users](https://auth0.com/docs/users/update-root-attributes-for-users) > [http://locahost:3001](http://locahost:3001) has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. I have added [http://locahost:3001](http://locahost:3001) to BOTH the Allowed Web Origins and Allowed Origins fields in my application settings. Please help! ---
**Author:** ![ruchi](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ruchi/32/18068_2.png) [@ruchi](https://community.auth0.com/u/ruchi)\ **Post date:** [May 21, 2021, 10:11pm UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/2 "2021-05-21T22:11:23Z")
> [@dave6](#): > > has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Hi @dave6 - Welcome to Auth0 community! Can you please clarify if you are using our [Universal login](https://auth0.com/docs/universal-login) solution or Embedded lock? Also, do you have a custom domain present in your tenant? ---
**Author:** ![dave6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dave6/32/26439_2.png) [@dave6](https://community.auth0.com/u/dave6)\ **Post date:** [May 21, 2021, 10:24pm UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/3 "2021-05-21T22:24:46Z")
Hi! Thank you for you prompt reply. I am using Universal Login, and I do not have a custom domain present in my tenant. I am having the issue for both my development and production environments. ---
**Author:** ![ruchi](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ruchi/32/18068_2.png) [@ruchi](https://community.auth0.com/u/ruchi)\ **Post date:** [May 23, 2021, 5:34pm UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/4 "2021-05-23T17:34:24Z")
Can you try and update url to **https** ://localhost:3001 instead of http:// - if that doesn’t work can you DM me the name of your tenant? ---
**Author:** ![dave6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dave6/32/26439_2.png) [@dave6](https://community.auth0.com/u/dave6)\ **Post date:** [May 23, 2021, 11:37pm UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/5 "2021-05-23T23:37:07Z")
That did not work. DM’ing you now. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [May 24, 2021, 10:26am UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/6 "2021-05-24T10:26:54Z")
Once you figure it out @ruchi please share it here in the topic for the benefit of others! ---
**Author:** ![dave6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dave6/32/26439_2.png) [@dave6](https://community.auth0.com/u/dave6)\ **Post date:** [May 26, 2021, 12:00am UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/7 "2021-05-26T00:00:01Z")
I have DM’d @ruchi a few days ago and I have gotten nothing back on this issue. This issue renders Auth0 completely useless. I will have to switch authentication services if I do not get help with this problem. @konrad.sopala ---
**Author:** ![ruchi](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ruchi/32/18068_2.png) [@ruchi](https://community.auth0.com/u/ruchi)\ **Post date:** [May 26, 2021, 4:00am UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/8 "2021-05-26T04:00:25Z")
> [@dave6](#): > > has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: Apologies for the delay @dave6 - Thank you for sending over the names of your tenants. Looking at your tenants, I see that the application you are using is a SPA - Are you also using our SPA SDK? In order for me to further troubleshoot, can you also please DM me a HAR file? Details on capturing a .har can be found here: > **[Generate and Analyze HAR Files](https://auth0.com/docs/troubleshoot/troubleshooting-tools/generate-and-analyze-har-files)** > > Learn how to troubleshoot with HAR files and steps to generate a HAR file. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [May 26, 2021, 11:41am UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/9 "2021-05-26T11:41:19Z")
Thanks for following up on that! ---
**Author:** ![dave6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dave6/32/26439_2.png) [@dave6](https://community.auth0.com/u/dave6)\ **Post date:** [May 27, 2021, 1:27am UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/10 "2021-05-27T01:27:41Z")
Yes I am using the SPA SDK - I am using React with the @auth0/auth0-react package. I am calling getTokenSilently with the SDK, and passing the token to the api/v2/users/user\_id endpoint to try to update the user. I will DM you a HAR file now ---
**Author:** ![ruchi](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ruchi/32/18068_2.png) [@ruchi](https://community.auth0.com/u/ruchi)\ **Post date:** [May 28, 2021, 6:30pm UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/11 "2021-05-28T18:30:27Z")
Thanks for sharing the HAR file, @dave6 - It looks like this isn’t a CORS failure–the OPTIONS method is not supported on the /authorize endpoint as it is expected the browser will request the page directly and not via an xhr request. Some alternatives here would be: - A redirect flow to /authorize with prompt=none - getTokenSilently() method if using the auth0-spa-js SDK - a refresh token flow (this can do an xhr request to /oauth/token) You could look into refresh token rotation: 1. [Refresh Token Rotation](https://auth0.com/docs/tokens/refresh-tokens/refresh-token-rotation) 2. With that setup you could likely extend the useful life of refresh tokens safely. 3. You could also consider increasing the length of the browser session and use checkSession in auth0.js or getTokenSilently in auth0-spa-js: - [Configure Silent Authentication](https://auth0.com/docs/authorization/configure-silent-authentication#renew-expired-tokens) (auth0.js) - [Auth0 Single Page App SDK](https://auth0.com/docs/libraries/auth0-single-page-app-sdk) (auth0-spa-js) Both of these will use the auth0 session cookie to request a new token in the background. Depending on your architecture this can cause unexpected behavior with Safari Intelligent Tracking Prevention and Chrome incognito mode. In that case refresh token rotation can sidestep those issues. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [June 12, 2021, 6:31pm UTC](https://community.auth0.com/t/cors-issues-on-localhost/63137/12 "2021-06-12T18:31:23Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.