I’m experiencing persistent CORS issues when trying to send events from my web container (GTM Web) to my GTM Server-Side container deployed on Cloud Run. Despite my best efforts and various tests, I still encounter the following error:

"Access to fetch at '/' from origin '' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled."

What I’ve Tried: Server-Side Client Configuration: In my GTM Server-Side container, I set up the CORS headers as follows in the onClientRequest function:

function onClientRequest(event) {
  event.logInfo("Support Container: Inizio elaborazione richiesta.");

  event.setResponseHeader("Access-Control-Allow-Origin", ";);
  event.setResponseHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
  event.setResponseHeader("Access-Control-Allow-Headers", "Content-Type");

  if (event.getRequestMethod && event.getRequestMethod() === 'OPTIONS') {
    return {
      continue: false,
      response: {
        status: 200,
        headers: {
          "Access-Control-Allow-Origin": ";,
          "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
          "Access-Control-Allow-Headers": "Content-Type"
        },
        body: ""
      }
    };
  }

  // For actual POST requests, I attempt to read the JSON
  var parsedBody = event.getJson();
  if (parsedBody) {
    event.logInfo("Support Container: Body interpretato come JSON:", parsedBody);
  } else {
    event.logInfo("Support Container: Body non è JSON o è vuoto.");
  }

  event.setData('payload_support', parsedBody);

  return { continue: true };
}

function onTags(event) {
  var payloadSupport = event.getData('payload_support') || null;
  event.logInfo("Support Container onTags: payload_support =", payloadSupport);
  return {
    payloadSupport: payloadSupport
  };
}

I’ve verified that the domain is set to (without a trailing slash) in both the header and in my web page’s origin.

• Fetch from Web Container: In my web container, I’m sending the payload using the following fetch:

  fetch('/', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) }) .then(response => response.text()) .then(data => { console.log("Response from server-side:", data); }) .catch(err => { console.error("Fetch error:", err); });

• Tests with Wildcard: I also tried setting Access-Control-Allow-Origin to "*" to rule out any domain mismatch issues, but the error persists.

• Outcome in GTM Server-Side Preview: Unfortunately, nothing is logged in the GTM Server-Side container when I send the request from my web container, which leads me to believe the request is blocked by the browser during the preflight (OPTIONS) phase. The preflight response is not returning the correct CORS headers (or is not being received at all), so the browser prevents the actual POST request.

What’s Happening? The browser is making a preflight OPTIONS request.

It’s expecting a response with status 200 and the following headers:

Access-Control-Allow-Origin: 

Access-Control-Allow-Methods: GET, POST, OPTIONS

Access-Control-Allow-Headers: Content-Type

Instead, the response is 400 (Bad Request) with no CORS headers, so the browser blocks the POST.

Questions:

• Why is my GTM Server-Side container not returning the correct CORS headers for the OPTIONS request?

• Is there a known issue with using a trailing slash or domain mismatches that could cause this preflight failure?

• Are there additional configurations required in Cloud Run or GTM to ensure that the preflight request is handled properly?

Any guidance on how to resolve this would be greatly appreciated. I’ve verified that the domain names and paths are correct, and I’ve tried both specific and wildcard origins. Still, the request is blocked at the preflight stage.

Thanks in advance for your help!