title: Access blocked by CORS policy: No 'Access-Control-Allow-Origin'
body: <p>I am using the following versions</p>
  <blockquote>
  <ul>
  <li>Python 3.9.6</li>
  <li>Django 3.2.3</li>
  <li>django-cors-headers==3.7.0</li>
  </ul>
  </blockquote>
  <p>I have the following in my settings.py</p>
  <blockquote>
  <p><code>CORS_ALLOW_ALL_ORIGINS=True</code></p>
  <p><code>CORS_ORIGIN_WHITELIST = ('http://localhost:3000',)</code></p>
  </blockquote>
  <p>For some reason, one of the API call fails out with this error.</p>
  <blockquote>
  <p>Access to fetch at  from origin  has been blocked by CORS policy: No 'Access-&gt;Control-Allow-Origin' header is present on the requested resource. If an opaque response serves &gt;your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.</p>
  </blockquote>
  <p>I am not able to understand why I get this error.</p>
  <p>Here are the relevant request and response details as extracted from Google Chrome Developer tools</p>
  <p><strong>General</strong>
  Request URL: <a href="http://10.0.123.123:8998/api/box?unit=101&amp;box=TOT000000000051345&amp;login_user_id=USERID&amp;reserve_locn=101" rel="nofollow noreferrer">http://10.0.123.123:8998/api/box?unit=101&amp;box=TOT000000000051345&amp;login_user_id=USERID&amp;reserve_locn=101</a></p>
  <p>Request Method: OPTIONS</p>
  <p>Status Code: 200 OK</p>
  <p>Remote Address: 10.0.123.123:8998</p>
  <p>Referrer Policy: strict-origin-when-cross-origin</p>
  <p><strong>Response Headers</strong>
  Access-Control-Allow-Headers: accept, accept-encoding, authorization, content-type, dnt, origin, user-agent, x-csrftoken, x-requested-with</p>
  <p>Access-Control-Allow-Methods: DELETE, GET, OPTIONS, PATCH, POST, PUT</p>
  <p>Access-Control-Allow-Origin: *</p>
  <p>Access-Control-Max-Age: 86400</p>
  <p>Connection: keep-alive</p>
  <p>Content-Length: 0</p>
  <p>Content-Type: text/html; charset=utf-8</p>
  <p>Date: Tue, 07 Sep 2021 01:15:10 GMT</p>
  <p>Server: nginx/1.20.1</p>
  <p>Vary: Origin</p>
  <p><strong>Request Headers</strong></p>
  <p>OPTIONS /api/box?unit=101&amp;box=TOT000000000051345&amp;login_user_id=USERID&amp;reserve_locn=101 HTTP/1.1</p>
  <p>Host: 10.0.123.123:8998</p>
  <p>Connection: keep-alive</p>
  <p>Accept: <em>/</em></p>
  <p>Access-Control-Request-Method: GET</p>
  <p>Access-Control-Request-Headers: content-type</p>
  <p>Origin: <a href="http://10.0.123.123:8999" rel="nofollow noreferrer">http://10.0.123.123:8999</a></p>
  <p>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36</p>
  <p>Sec-Fetch-Mode: cors</p>
  <p>Referer: <a href="http://10.0.123.123:8999/" rel="nofollow noreferrer">http://10.0.123.123:8999/</a></p>
  <p>Accept-Encoding: gzip, deflate</p>
  <p>Accept-Language: en-GB,en-US;q=0.9,en;q=0.8</p>