How to Handle CORS in Microservices: Causes and Fixes

In microservices, handle CORS by configuring each service or an API gateway to send the correct Access-Control-Allow-Origin headers. This allows browsers to permit cross-origin requests safely between your frontend and backend services.

Why This Happens

CORS errors occur because browsers block requests from one origin (like your frontend) to another origin (like a microservice) unless the server explicitly allows it. This is a security feature to prevent malicious sites from accessing your data.

In microservices, each service runs on different domains or ports, so browsers treat them as different origins. If the service does not send the right CORS headers, the browser blocks the request.

javascript

const express = require('express');
const app = express();

app.get('/data', (req, res) => {
  res.json({ message: 'Hello from microservice' });
});

app.listen(3001, () => console.log('Service running on port 3001'));

Output

Access to fetch at 'http://localhost:3001/data' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

The Fix

To fix CORS errors, configure your microservice to send the Access-Control-Allow-Origin header with the allowed origin or * for all origins. You can use middleware like cors in Express.js to handle this easily.

javascript

const express = require('express');
const cors = require('cors');
const app = express();

app.use(cors({ origin: 'http://localhost:3000' }));

app.get('/data', (req, res) => {
  res.json({ message: 'Hello from microservice' });
});

app.listen(3001, () => console.log('Service running on port 3001 with CORS enabled'));

Output

Service running on port 3001 with CORS enabled

Browser successfully fetches data from http://localhost:3001/data without CORS errors.

Prevention

To avoid CORS issues in the future, follow these best practices:

• Centralize CORS handling in an API gateway if you use one, so microservices don't need individual CORS setup.
• Specify exact origins instead of using * to improve security.
• Use automated tests to check CORS headers in your CI/CD pipeline.
• Document allowed origins clearly for frontend and backend teams.

Related Errors

Other common errors related to CORS include:

• Preflight request failures: When browsers send an OPTIONS request before the actual request and the server does not respond correctly.
• Credential issues: When requests include cookies or authorization headers but the server does not allow credentials.
• Incorrect methods or headers: When the server does not allow certain HTTP methods or headers used by the client.

Fix these by configuring Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Allow-Credentials properly.

Key Takeaways

Always configure CORS headers on microservices or API gateways to allow trusted origins.

Use middleware or built-in frameworks features to simplify CORS setup.

Avoid using wildcard (*) origins in production for better security.

Test CORS behavior regularly to catch issues early.

Handle preflight OPTIONS requests correctly to prevent failures.