Enable CORS in Flask with flask-cors

Install the extension (pip install flask-cors) and wrap the app: CORS(app) adds Access-Control-Allow-Origin: * to every response and answers preflight OPTIONS requests. For a real API, restrict it with CORS(app, origins=[...]) or per path with resources={r"/api/*": {...}}, and add supports_credentials=True only when the browser must send cookies.

Setup and check with the Flask test client

The test client sends the same Origin and Access-Control-Request-* headers a browser sends, without starting a server:

cat > app.py <<'EOF'
from flask import Flask
from flask_cors import CORS

app = Flask(__name__)
CORS(app, origins=["https://app.example.com", "https://admin.example.com"],
     supports_credentials=True)

@app.get("/items")
def items():
    return {"ok": True}

def show(title, resp):
    print("==", title, resp.status_code)
    for k in sorted(resp.headers.keys()):
        if k.startswith("Access-Control") or k == "Vary":
            print(f"{k}: {resp.headers[k]}")

c = app.test_client()
show("GET from an allowed origin", c.get("/items", headers={"Origin": "https://app.example.com"}))
show("preflight", c.options("/items", headers={
    "Origin": "https://admin.example.com",
    "Access-Control-Request-Method": "PUT",
    "Access-Control-Request-Headers": "content-type"}))
show("GET from another origin", c.get("/items", headers={"Origin": "https://evil.example"}))
EOF
uv run -q --no-project --python 3.13 --with "flask>=3,<4" --with "flask-cors>=6,<7" python app.py

== GET from an allowed origin 200
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://app.example.com
Vary: Origin
== preflight 200
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
Access-Control-Allow-Origin: https://admin.example.com
Vary: Origin
== GET from another origin 200

The allowed origins are reflected with Vary: Origin and Access-Control-Allow-Credentials: true. The preflight echoes the requested header and lists the default methods. The third request still runs the view and returns 200, but without CORS headers, so a browser on that origin cannot read it.

Common options

Restrict CORS to the API

CORS(app, resources={r"/api/*": {"origins": ["https://app.example.com"]}})

Routes outside /api/ then get no CORS headers at all, which is what you want for HTML pages and admin views.

Pitfalls

• If you set allow_headers explicitly, every header the front end sends (for example Authorization) must be in it, or the browser reports Request header field is not allowed.
• An origin includes scheme and port: during development, http://localhost:5173 must be on the list, not only localhost.
• Do not also add Access-Control-Allow-Origin in nginx or a gateway: two values make the browser reject the response.
• Test from the command line with curl and an Origin header; curl shows the headers but never blocks anything.

FAQ