CORS & Request Modes in JavaScript

From the Fetch API cheat sheet · Request Configuration · verified Jul 2026

CORS & Request Modes

Handling Cross-Origin Resource Sharing and request modes

javascript
// CORS modes
await fetch(url, {
  mode: 'cors'        // Default - follows CORS protocol
})

await fetch(url, {
  mode: 'no-cors'     // Limited, opaque response
})

await fetch(url, {
  mode: 'same-origin' // Only same-origin requests
})

// Credentials (cookies, auth headers)
await fetch(url, {
  credentials: 'include'     // Always send
})

await fetch(url, {
  credentials: 'same-origin' // Same-origin only (default)
})

await fetch(url, {
  credentials: 'omit'        // Never send
})

// Handling CORS errors
try {
  const response = await fetch('https://api.external.com/data', {
    mode: 'cors',
    credentials: 'include',
    headers: {
      'Content-Type': 'application/json'
    }
  })
  
  if (!response.ok) {
    throw new Error(\`HTTP error! status: \${response.status}\`)
  }
  
  const data = await response.json()
} catch (error) {
  if (error instanceof TypeError) {
    console.error('CORS error or network failure:', error)
  }
}
⚠️ no-cors mode severely limits response access
🔐 credentials: include needed for cross-origin cookies
💡 Preflight requests happen with custom headers
📌 CORS errors appear as network failures in fetch

More JavaScript tasks

Back to the full Fetch API cheat sheet