List the real production and approved staging frontend origins. Determine whether requests use cookies or other credentials and which methods and headers are necessary.

1. Configure CORSMiddleware with the specific permitted origins. Use exact origins, including the scheme and non-default port where relevant.

2. Allow only the methods and request headers the frontend needs. If credentialed requests are enabled, use explicit settings rather than wildcard origins, methods or headers.

3. Keep authentication and authorization in the API. CORS controls browser access behavior and does not verify that a caller is entitled to perform an operation.

4. Test the browser preflight request and the following API request. Include the same credentials mode the production frontend uses.

5. Review error responses and proxy behavior so required CORS headers are not lost on a failure or redirect.

For an API used by the specific HTTPS website shown below, merge this middleware configuration into the existing application. The explicit lists describe the origins, methods and headers needed by that frontend. Add another origin only after verifying its ownership and purpose.

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()
app.add_middleware(
    CORSMiddleware,
    allow_origins=['https://www.example.com'],
    allow_credentials=True,
    allow_methods=['GET', 'POST'],
    allow_headers=['Authorization', 'Content-Type'],
)

Keep route authentication, authorisation and any required CSRF protection. Cookie domain and SameSite settings must also fit the deployment. If the frontend never uses cookies, review whether credentialed CORS is needed at all. An allowed origin is not permission to read another account’s data.

Expected result: The browser’s preflight and approved request both succeed. A request from an unapproved browser origin is not granted credentialed access, while an unauthorised user still fails the API’s own permission checks.

Confirm the approved frontend can perform the intended request and an unapproved browser origin cannot read a protected response. Verify cookies also meet their domain and SameSite requirements.

If a request works in a server-side client but fails in a browser, inspect the preflight and response headers. That difference does not prove the API credentials or database are wrong.

• Configuring FastAPI root paths and proxy headers
• Troubleshooting browser CORS errors for an API
• Validating API input before using it in a database
• Choosing FastAPI workers within a memory budget

• FastAPI CORS
• MDN CORS