CORS is enforced by the browser, not the server, so curl never sees it. The request probably reached the server and the response simply lacked an allow origin header the browser accepted, or a preflight OPTIONS failed. Check the network tab for the OPTIONS request and its response headers, confirm the allowed origin, methods and headers cover your call, and remember credentials require an explicit origin plus allow credentials, never a wildcard.
Why interviewers ask this
Every frontend developer hits this, and the answer reveals whether you understand the browser security model or just copy a proxy config until the error disappears. The interviewer wants to hear that CORS protects the response, that a preflight is triggered by non simple methods, headers or content types, and that the fix belongs on the server. Suggesting you disable web security in the browser is a fail.
How to structure your answer
- State that the browser enforces it, which is why curl works.
- Separate the preflight from the actual request in the network tab.
- Map the specific error message to the missing header.
- Say where the fix belongs and what you would ask the backend for.
Example answer
The first thing I say is that CORS is a browser rule, not a server rule, so curl succeeding tells me nothing except that the endpoint is up. The browser made the request, or a preflight for it, and refused to hand me the response because the headers did not allow my origin. So I open the network tab and look for an OPTIONS request first. If it is there and returns a 4xx, the preflight itself is failing, usually because I added a custom header or a JSON content type that pushed it out of the simple request category, and the server's allowed headers list does not include it. If there is no preflight, then the actual response is missing an allow origin header that matches my origin. The fix is server side. In local development I proxy through the dev server so my origin matches, but I make sure the real headers are configured too, otherwise it breaks in staging. And if the call sends cookies, the server has to echo a specific origin plus allow credentials, since a wildcard is rejected in that case.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- What makes a request simple enough to skip the preflight?
- Why does a wildcard origin not work with credentialed requests?
- How would you debug this if the network tab shows no response at all?
Related frontend developer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions