Hey team, we recently have been having CORS issues with our refresh requests to validate tokens, breaking some user sessions and e2e tests. this is the error we have been getting

Access to fetch at '<https://access.blockaid.io/v1/auth/refresh?dcs=t&dcr=f>' from origin '<http://localhost:8788>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

We'd love for your help on the matter 🙂

CORS Configuration Issue The error indicates your localhost development environment isn't configured as an allowed origin in your Descope project settings. Check Domain Settings 1. Go to your Descope Console → Applications 2. Find your application configuration 3. Add

<http://localhost:8788>

to your allowed origins/domains list For security, Descope checks the origin value against the domain setup for your application in the console . The origin value should be either the same or a subdomain of the domain setting in the console . Alternative Solutions If you're using a custom domain, you can configure a Cloudflare Worker proxy that manages CORS headers automatically . This adjusts the CORS headers in the response to ensure the browser permits resource sharing between domains . For local development with cookies, consider using the

sessionTokenViaCookie

parameter in your SDK, which handles localhost cookie setup automatically . Four Common CORS Errors and How to Fix Them Biometrics (Passkeys) | Backend SDK | Descope Documentation Manage Sessions Across Domains With Descope and Cloudflare Workers Testing Cookies Locally | Descope Documentation

I sometimes get the same error on the "next" request as well, preventing me from authenticating completely

Multi-Step Authentication Flow Issue The CORS error on your "next" request suggests the authentication flow involves multiple API calls, and each needs proper CORS configuration. Complete Domain Configuration 1. Add

<http://localhost:8788>

to all relevant sections in your Descope Console: - Application settings → Allowed Origins - Authentication method settings (if using passkeys/WebAuthn) - Any OAuth provider configurations 2. Verify your refresh token endpoint is also configured for localhost access Authentication Flow Steps The authentication process typically involves multiple requests: 1. Initial authentication request 2. Session validation 3. Token refresh (where you're seeing the error) 4. Final session establishment Each step must have proper CORS headers configured. SDK Configuration If using a Descope SDK, ensure you're using the

sessionTokenViaCookie

parameter for localhost development . This helps handle cross-origin cookie issues during local development. Debugging Steps Check your browser's Network tab to identify which specific endpoint is failing the CORS check. The error might be occurring on session validation or token refresh endpoints that need separate domain configuration. Adding MFA to Homegrown Auth With Descope Testing Cookies Locally | Descope Documentation

I can't see "Application Settings" do you mean the "approved Domains" list in the project settings? I added the localhost there twice, once with http:// and once without as a domain. what more can I do?

Correct Configuration Location Yes, you're in the right place! The "Approved Domains" list in Project Settings → Security is where you configure allowed origins for CORS. Domain Format Issue For web domains, enter the domain only without the protocol. Instead of

<http://localhost:8788>

, try: 1. Remove both entries you added 2. Add just:

localhost:8788

(without http://) Additional Troubleshooting If the issue persists after fixing the domain format: 1. Check browser cache - Clear browser cache and cookies for your localhost domain 2. Verify the exact URL - Ensure the port number matches exactly what your app is running on 3. Test with different ports - Try adding

localhost:3000

or other common dev ports if your setup uses multiple Alternative Solution If domain configuration doesn't resolve it, consider using a Cloudflare Worker proxy that automatically manages CORS headers for cross-domain requests. This adjusts CORS headers in responses to ensure browsers permit resource sharing between different origins. The approved domains setting controls redirect and verification URLs across authentication methods, so the correct format is crucial for proper CORS handling. Project Settings | Descope Documentation Manage Sessions Across Domains With Descope and Cloudflare Workers

the localhost domain was already there, we didn't change anything in our flow, were there any recent changes on your side that might be the reason this whole CORS thing started suddenly happening?

Platform Changes I don't have access to specific information about recent platform changes that might have caused sudden CORS issues. The documentation doesn't indicate any recent breaking changes to CORS handling. Possible Causes Since your localhost domain was already configured and nothing changed on your end, consider these factors: 1. Browser updates - Recent browser security updates can change CORS enforcement 2. Network changes - Corporate firewalls or proxy configurations 3. SDK version - If you updated any Descope SDKs recently 4. Environment variables - Check if any environment configs changed Immediate Solutions 1. Hard refresh - Try Ctrl+F5 or clearing all browser data for localhost 2. Different browser - Test in an incognito window or different browser 3. Check exact domain format - Ensure it's

localhost:8788

(no protocol) in approved domains 4. Verify port consistency - Confirm your app is actually running on 8788 Next Steps If the issue persists, I'd recommend contacting Descope support directly with your project ID and specific error details. They can check for any recent infrastructure changes or account-specific issues that might be causing the sudden CORS problems. The timing suggests this might be related to external factors rather than Descope platform changes, but support can provide definitive answers about any recent updates.