CORS & Request Modes in JavaScript
From the Fetch API cheat sheet · Request Configuration · verified Jul 2026
CORS & Request Modes
Handling Cross-Origin Resource Sharing and request modes
javascript
// CORS modes
await fetch(url, {
mode: 'cors' // Default - follows CORS protocol
})
await fetch(url, {
mode: 'no-cors' // Limited, opaque response
})
await fetch(url, {
mode: 'same-origin' // Only same-origin requests
})
// Credentials (cookies, auth headers)
await fetch(url, {
credentials: 'include' // Always send
})
await fetch(url, {
credentials: 'same-origin' // Same-origin only (default)
})
await fetch(url, {
credentials: 'omit' // Never send
})
// Handling CORS errors
try {
const response = await fetch('https://api.external.com/data', {
mode: 'cors',
credentials: 'include',
headers: {
'Content-Type': 'application/json'
}
})
if (!response.ok) {
throw new Error(\`HTTP error! status: \${response.status}\`)
}
const data = await response.json()
} catch (error) {
if (error instanceof TypeError) {
console.error('CORS error or network failure:', error)
}
}⚠️ no-cors mode severely limits response access
🔐 credentials: include needed for cross-origin cookies
💡 Preflight requests happen with custom headers
📌 CORS errors appear as network failures in fetch