# Domain has been blocked by CORS policy: No 'Access-Control-Allow-Origin' **URL:** \ **Category:** Get Help\ **Tags:** cors\ **Created:** [April 21, 2021, 8:35pm UTC](https://community.auth0.com/t/domain-has-been-blocked-by-cors-policy-no-access-control-allow-origin/61515 "2021-04-21T20:35:54Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![luuuis](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/luuuis/32/27105_2.png) [@luuuis](https://community.auth0.com/u/luuuis)\ **Post date:** [April 22, 2021, 2:37pm UTC](https://community.auth0.com/t/domain-has-been-blocked-by-cors-policy-no-access-control-allow-origin/61515/2 "2021-04-22T14:37:02Z")
> [@JulesR2](#): > > Access to XMLHttpRequest at ‘auth0domain/authorize?scope=openid%20email%20profile&response\_mode=query&response\_type=code&redirect\_uri=https%3A%2F%2Fst-frontend.auth.test%3A4200%2F&state=da30ce31ccc45bd7e1e18a9ec861c1c1&nonce=c1dfae0ab77213c18b4dd064620d35b7&client\_id=clientID’ (redirected from ‘[https://st-backend.dev/api/v1/auth’](https://st-backend.dev/api/v1/auth%E2%80%99)) from origin ‘[https://st-frontend.auth.test:4200](https://st-frontend.auth.test:4200)’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Your snippet indicates that you are using XMLHttpRequest. Calls to `/authorize` can never be made with XMLHttpRequest. They should only be made via a redirect or other top-level browser navigation and this is why CORS is not supported at that API. Please check this similar question where I explained this in a bit more detail [Received CORS issue trying to reproduce quickstart demo in Rails - #4 by luuuis](https://community.auth0.com/t/received-cors-issue-trying-to-reproduce-quickstart-demo-in-rails/60143/4) Hope this helps. --- _[View the full topic](https://community.auth0.com/t/domain-has-been-blocked-by-cors-policy-no-access-control-allow-origin/61515)._