A CORS error is a browser policy decision about one cross-origin request, not a generic server connectivity failure. Start with the exact request origin, target URL, method and credentials mode. Then inspect the response headers from the endpoint that actually answers—including CDN/cache variants.
Capture the failing browser request
Record Origin, target, method, status, console message and whether cookies/Authorization are sent. “Blocked by CORS” is not enough to choose a fix.
Check preflight when present
OPTIONS must reach the correct application/proxy route and return allowed method/headers. A 301, 403 or cached HTML response to preflight will fail before the real request.
Set a precise allowed origin
For credentialed requests, wildcard origin is invalid. Return the expected scheme+host and include credentials only where the application genuinely needs them.
Find which layer owns the headers
Application, nginx, CDN, API gateway and security plugin can each add/remove CORS headers. Duplicate or conflicting values can be as broken as missing ones.
Make cache variation safe
If the response changes by Origin, ensure caching respects that variation. An edge can otherwise serve an Access-Control-Allow-Origin value generated for another site.
Test the business path, not only curl
curl can show headers but does not enforce browser CORS policy. Re-test in a browser with the same credentials, method and origin used by checkout or the frontend.
If the endpoint is timing out rather than returning a CORS response, switch to the 504 diagnosis; if the wrong backend is answering, verify DNS after migration.