CORS & Request Modes in JavaScript

From the Fetch API cheat sheet · Request Configuration · verified Jul 2026

CORS & Request Modes

Handling Cross-Origin Resource Sharing and request modes

javascript
// CORS modes
await fetch(url, {
  mode: 'cors'        // Default - follows CORS protocol
})

await fetch(url, {
  mode: 'no-cors'     // Limited, opaque response
})

await fetch(url, {
  mode: 'same-origin' // Only same-origin requests
})

// Credentials (cookies, auth headers)
await fetch(url, {
  credentials: 'include'     // Always send
})

await fetch(url, {
  credentials: 'same-origin' // Same-origin only (default)
})

await fetch(url, {
  credentials: 'omit'        // Never send
})

// Handling CORS errors
try {
  const response = await fetch('https://api.external.com/data', {
    mode: 'cors',
    credentials: 'include',
    headers: {
      'Content-Type': 'application/json'
    }
  })
  
  if (!response.ok) {
    throw new Error(\`HTTP error! status: \${response.status}\`)
  }
  
  const data = await response.json()
} catch (error) {
  if (error instanceof TypeError) {
    console.error('CORS error or network failure:', error)
  }
}
⚠️ no-cors mode severely limits response access
🔐 credentials: include needed for cross-origin cookies
💡 Preflight requests happen with custom headers
📌 CORS errors appear as network failures in fetch

Continue with Fetch API

Save the full cheat sheet or work through every related task.

More JavaScript tasks

Back to the full Fetch API cheat sheet