CORS error, but only in production

A browser rule, applied to a name that was different yesterday.

We have not measured how often this happens, because it depends entirely on which services an app talks to.

What is actually happening

A browser will only let a page call another origin if that origin says it may. The preview address given to you by the builder is a different origin from your own domain, and permissions granted to one do not extend to the other.

So nothing broke at deploy. The app simply started calling from a name the service has never been told to accept.

Confirm it in one command

curl -sI -H 'Origin: https://yourapp.com' https://api.yourservice.com/ | grep -i access-control

No `access-control-allow-origin` line coming back means the service has not been told about your domain.

Fixing it yourself

• Add your production domain to the allowed origins of whatever you are calling — the database, the API, the payment provider.
• Add it in every one of them. Missing a single service produces exactly the same symptom.

Where it stops being a small job

When the service is yours and the header is being set by something you do not control — a proxy, a CDN, a hosting layer that rewrites responses. Then the header you configured and the header that arrives are different things.