# No 'Access-Control-Allow-Origin' header issue **URL:** \ **Category:** Get Help\ **Tags:** wordpress-login, wordpress-auth0, cors, wordpress\ **Created:** [April 3, 2020, 2:32pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467 "2020-04-03T14:32:20Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![developer6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/developer6/32/12814_2.png) [@developer6](https://community.auth0.com/u/developer6)\ **Post date:** [April 3, 2020, 2:32pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/1 "2020-04-03T14:32:21Z")
Hi, We’re getting the following error after upgrading Auth0 WP plugin to v4.0.0. `Access to XMLHttpRequest at 'https:/[our auth0 account].eu.auth0.com/usernamepassword/challenge' from origin 'https://[our domain].com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.` Our domain ( https://[our domain].com ) as well as the page ( https://[our domain].com/dashboard ) where the Auth0 powered login is placed are added to **Allowew Origins (CORS)** field in our Application settings but the issue still exists. Any recommendation on how to tackle this issue? Thank you ---
**Author:** ![lucas.sonich](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lucas.sonich/32/17240_2.png) [@lucas.sonich](https://community.auth0.com/u/lucas.sonich)\ **Post date:** [April 3, 2020, 3:07pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/2 "2020-04-03T15:07:10Z")
Hello! Welcome to our community. You would have to set your actual domain in the Allowed Web Origins field. Please, let us know if that solution works for you. Thanks. ---
**Author:** ![developer6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/developer6/32/12814_2.png) [@developer6](https://community.auth0.com/u/developer6)\ **Post date:** [April 3, 2020, 3:27pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/3 "2020-04-03T15:27:04Z")
Hi Lucas, Thank you for response. The domain is set properly in Allowed Web Origins field but we’re still getting the same error ( please see below ). ![2020-04-03-uojqf](https://global.discourse-cdn.com/auth0/original/3X/3/e/3e39a1f8e694c33cdef66830ddcb93a83b54ab3b.jpeg) I’m attaching a screenshot of other fields as well, which might give you an idea of our setup: ![2020-04-03-mzh1b](https://global.discourse-cdn.com/auth0/original/3X/2/0/2096dc045c2e7f98fe6483407c16b6433851d6a7.jpeg) Thank you ---
**Author:** ![lucas.sonich](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lucas.sonich/32/17240_2.png) [@lucas.sonich](https://community.auth0.com/u/lucas.sonich)\ **Post date:** [April 3, 2020, 3:44pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/4 "2020-04-03T15:44:17Z")
Hi again! Please, **make sure** to set the domain on both Allowed Web Origins and Allowed Origins (CORS). Please, try that and see if that works! Thanks. ---
**Author:** ![developer6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/developer6/32/12814_2.png) [@developer6](https://community.auth0.com/u/developer6)\ **Post date:** [April 3, 2020, 3:51pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/5 "2020-04-03T15:51:30Z")
Hi again, Tried that now. But still no change unfortunately. ![2020-04-03-tlynn](https://global.discourse-cdn.com/auth0/original/3X/c/6/c67aa54ea01e4d43966dedf984b545cd491306c0.jpeg) Thank you ---
**Author:** ![itdstv.com](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/itdstv.com/32/15311_2.png) [@itdstv.com](https://community.auth0.com/u/itdstv.com)\ **Post date:** [April 7, 2020, 2:23pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/6 "2020-04-07T14:23:02Z")
Hi, we have the same issue after upgrading. Did all the steps below. How was it solved at your end developer6? Access to XMLHttpRequest at ‘https:/[our auth0 account].eu.auth0.com/usernamepassword/challenge’ from origin ‘https://[our domain].com’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. ---
**Author:** ![robert4](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@robert4](https://community.auth0.com/u/robert4)\ **Post date:** [April 8, 2020, 1:24am UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/7 "2020-04-08T01:24:55Z")
We’re getting the same issue since updating to the wordpress plugin v4.0. We set the domain in both Allowed Web Origins and Allowed Origins (CORS). Our error is identical to the one above. ---
**Author:** ![developer6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/developer6/32/12814_2.png) [@developer6](https://community.auth0.com/u/developer6)\ **Post date:** [April 8, 2020, 10:46am UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/8 "2020-04-08T10:46:57Z")
@itdstv.com & @robert4 Unfortunately we have not solved it yet. Downgraded to v3.11.3 until we have a solution. ---
**Author:** ![josh.cunningham](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/josh.cunningham/32/16289_2.png) [@josh.cunningham](https://community.auth0.com/u/josh.cunningham)\ **Post date:** [April 10, 2020, 4:57pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/9 "2020-04-10T16:57:53Z")
Apologies for the trouble here and happy to help troubleshoot. Can someone post what page(s) that this error is appearing on and what action is being taken to generate it? Also, if you can post any non-default settings you’re using, specifically: - Custom domain? - Universal login? - Widget or shortcode login form? - Passwordless? Anything you can provide around how to reproduce this error would be helpful. Thank you! ---
**Author:** ![developer6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/developer6/32/12814_2.png) [@developer6](https://community.auth0.com/u/developer6)\ **Post date:** [April 15, 2020, 10:01am UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/10 "2020-04-15T10:01:39Z")
Hi, Unfortunately we don’t have a live environment which uses v4.0 atm. But I can say the following regarding our settings: - Custom domain: No - Universal login: No - Widget or shortcode login form: Yes - Passwordless: No Also: - The error occurs right way on page load - WP v5.3.2, WooCommerce v3.9.2 and PHP v7.3 is the setup we have p.s. I might be able to create a staging environment with v4.0. I’d rather not share the URL here publicly ( company policy ). I can share it via a PM though. Thank you ---
**Author:** ![josh.cunningham](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/josh.cunningham/32/16289_2.png) [@josh.cunningham](https://community.auth0.com/u/josh.cunningham)\ **Post date:** [April 15, 2020, 1:35pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/11 "2020-04-15T13:35:40Z")
> The error occurs right way on page load Just on wp-login.php? > Universal login: No Have you considered switching to Universal Login? The embedded login form won’t remain in the plugin indefinitely. ---
**Author:** ![art.rosnovsky](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/art.rosnovsky/32/17937_2.png) [@art.rosnovsky](https://community.auth0.com/u/art.rosnovsky)\ **Post date:** [April 30, 2020, 6:16pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/12 "2020-04-30T18:16:14Z")
Hey guys, I’m trying to reproduce this in order to see if there’s a way to troubleshoot it. If you’re still experiencing this issue, could you please let me know how to best replicate this? I understand you’re on WP 5.3.2, and upgraded from Auth0 WP plugin 3.11.3 to v4.0 and CORS started to popup in the console. There’s also WooCommerce plugin installed, and you’re using embedded login. Any additional details and specifics would be greatly appreciated. Also, if you have specific concerns with migrating to new Universal Login experience, I’d be happy to address them! ---
**Author:** ![alex20](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alex20/32/13075_2.png) [@alex20](https://community.auth0.com/u/alex20)\ **Post date:** [May 20, 2020, 8:26am UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/13 "2020-05-20T08:26:33Z")
This is still an issue for me. I’m using my Nodejs API which has a route which redirects me to the login page. This is what happens localhost:3000/auth/login2 → localhost:5000/auth/login2 → calls the Auth0 Passport Strategy But I don’t get redirected to login in the react front-end as this is the error I get. ---
**Author:** ![ganeshmani009](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ganeshmani009/32/23251_2.png) [@ganeshmani009](https://community.auth0.com/u/ganeshmani009)\ **Post date:** [August 18, 2020, 7:18am UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/14 "2020-08-18T07:18:50Z")
Yea. I am also facing the same issue. i am getting this error on /authorize ---
**Author:** ![eminciftci125](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/eminciftci125/32/20828_2.png) [@eminciftci125](https://community.auth0.com/u/eminciftci125)\ **Post date:** [September 16, 2020, 5:35pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/15 "2020-09-16T17:35:56Z")
Hi, I am facing same problem. Do you find any solution? ---
**Author:** ![asd99304](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/asd99304/32/14581_2.png) [@asd99304](https://community.auth0.com/u/asd99304)\ **Post date:** [October 2, 2020, 5:57pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/16 "2020-10-02T17:57:28Z")
Try to check if in you are passing correct `client_id` to the request. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [October 5, 2020, 9:12am UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/17 "2020-10-05T09:12:24Z")
Thanks for sharing that tip with the rest of community! ---
**Author:** ![aya.ashraf](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/aya.ashraf/32/23008_2.png) [@aya.ashraf](https://community.auth0.com/u/aya.ashraf)\ **Post date:** [October 18, 2020, 10:58pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/18 "2020-10-18T22:58:10Z")
I face the same problem any updates to this issue? ---
**Author:** ![aranderia15](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/aranderia15/32/27094_2.png) [@aranderia15](https://community.auth0.com/u/aranderia15)\ **Post date:** [February 1, 2021, 8:29pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/19 "2021-02-01T20:29:49Z")
I am still facing this issue. Any updates? ---
**Author:** ![ajv](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ajv/32/8910_2.png) [@ajv](https://community.auth0.com/u/ajv)\ **Post date:** [February 4, 2021, 8:52pm UTC](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467/20 "2021-02-04T20:52:12Z")
We are also facing this issue on a rather large scale. @konrad.sopala any way to escalate this? It’s a service blocker atm for us [Next page](https://community.auth0.com/t/no-access-control-allow-origin-header-issue/40467.md?page=2)