Domain has been blocked by CORS policy: No 'Access-Control-Allow-Origin'

[luuuis]

@JulesR2

Access to XMLHttpRequest at ‘auth0domain/authorize?scope=openid%20email%20profile&response_mode=query&response_type=code&redirect_uri=https%3A%2F%2Fst-frontend.auth.test%3A4200%2F&state=da30ce31ccc45bd7e1e18a9ec861c1c1&nonce=c1dfae0ab77213c18b4dd064620d35b7&client_id=clientID’ (redirected from ‘https://st-backend.dev/api/v1/auth’) from origin ‘https://st-frontend.auth.test:4200’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

Your snippet indicates that you are using XMLHttpRequest. Calls to /authorize can never be made with XMLHttpRequest. They should only be made via a redirect or other top-level browser navigation and this is why CORS is not supported at that API.

Please check this similar question where I explained this in a bit more detail Received CORS issue trying to reproduce quickstart demo in Rails - #4 by luuuis

Hope this helps.