Get a $149 diagnosis

Error library

Symptom: CORS error calling Supabase Edge Function

The browser blocked the call because the function didn't answer the OPTIONS preflight or return CORS headers. Use Supabase's withSupabase wrapper, which handles CORS and preflight for you, or handle OPTIONS yourself and add CORS headers to every response, including errors.

Cause: The function doesn't answer the preflight or omits Access-Control-Allow-Origin / allowed headers.

How to fix it

  1. If available in your setup, wrap the handler with withSupabase (per Supabase's CORS guide) so CORS is handled automatically.
  2. Otherwise, return early for OPTIONS requests with the CORS headers.
  3. Include the CORS headers on every response, including error responses.
  4. Allow the headers supabase-js sends (authorization, x-client-info, apikey, content-type).
  5. Restrict the allowed origin to your domain in production.

Example

Illustrative example, not from a customer project.

+ if (req.method === 'OPTIONS') return new Response('ok', { headers: corsHeaders })
- return new Response(JSON.stringify(data))
+ return new Response(JSON.stringify(data), { headers: { ...corsHeaders, 'Content-Type': 'application/json' } })

FAQ

Why does it work with curl?

CORS is enforced only by browsers.

Do errors need CORS headers too?

Yes, otherwise the browser hides the real error behind a CORS message.

Get a $149 diagnosis See pricing Still exposed or still logged out? Get an auth & database security fix (Supabase, Firebase).

$149Get a $149 diagnosis