I'm trying to upload an image to imgur with js (browser) and get a CORS error:

Access to XMLHttpRequest at '' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

But preflight request contains Access-Control-Allow-Origin header:

The request itself:

What I'm missing? this is because access-control-allow-credentials set to true?

I'm trying to upload an image to imgur with js (browser) and get a CORS error:

Access to XMLHttpRequest at 'https://api.imgur./3/upload' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

But preflight request contains Access-Control-Allow-Origin header:

The request itself:

What I'm missing? this is because access-control-allow-credentials set to true?

• javascript
• cors
• imgur

• 1 The screenshot clearly shows access-control-allow-origin: * but the error says it's not there. I suspect the error is referring to a different request. – Sidney Commented Apr 17, 2019 at 17:46
• Thanks, I added also a screenshot of the request itself. maybe I don't understand something with the CORS workflow. – Michael Commented Apr 17, 2019 at 17:50
• The request screenshot doesn't seem to include the response headers? – Sidney Commented Apr 17, 2019 at 17:54
• The browser blocks the response because of the CORS policy. – Michael Commented Apr 17, 2019 at 17:56
• 1 Since the preflight request succeeded with CORS headers, the browser should send the POST request. If the POST response doesn't have CORS headers, the browser disallows JavaScript from accessing the response. It should still show in the devtools though. What if you run the same request outside a browser? Maybe in Postman. Do you see CORS headers there? – Sidney Commented Apr 17, 2019 at 18:00

2 Answers 2

The problem was with their API Docs :\ The URL is: https://api.imgur./3/image and not https://api.imgur./3/upload as said here: https://apidocs.imgur./#c85c9dfc-7487-4de2-9ecd-66f727cf3139

according to doc https://api.imgur./3/upload doesnt have necessary header ,

but on the right side ,the curl example use https://api.imgur./3/image has Access-Control-Allow-Origin header

and somehow they will check your referer, which means if you are in develop mode like webpack dev mode use localhost:8000 it will always return 429 too many request exception