error fix
n8n CORS Error on Webhooks: What to Check
For browser-to-webhook calls, configure the Webhook node's allowed origins and verify the request method, response headers, and reverse proxy behavior. For sensitive operations, route through a backend instead.
Independent third-party notes. n8n is a trademark of its owner and is referenced only for compatibility and troubleshooting context.
Quick Answer
For browser-to-webhook calls, configure the Webhook node's allowed origins and verify the request method, response headers, and reverse proxy behavior. For sensitive operations, route through a backend instead.
Problem Pattern
CORS errors are browser enforcement problems, not generic API failures. They usually happen when frontend code calls an n8n webhook from a domain that the webhook or proxy has not allowed.
Key Facts
- Where it appears
- CORS errors usually appear in the browser console before frontend code can read the response.
- n8n control
- The Webhook node has an Allowed Origins (CORS) option.
- Proxy risk
- A reverse proxy can add, remove, or conflict with CORS headers.
- Security note
- CORS is not authentication and should not be treated as a secret-protection mechanism.
Recommended Steps
- Confirm the request is coming from a browser, not a backend or curl command.
- Check the origin shown in the browser console.
- Configure the Webhook node's Allowed Origins option for the intended frontend domain.
- Verify the HTTP method and any preflight behavior expected by the browser.
- If a reverse proxy sits in front of n8n, confirm it does not overwrite or duplicate CORS headers.
Verification
- The browser console no longer reports a CORS block.
- The response contains the expected access-control headers for the frontend origin.
- The webhook execution appears in n8n after the browser request.
- A disallowed origin is still blocked or routed safely.
Warnings
- Do not set broad origins casually for webhooks that can trigger sensitive actions.
- CORS fixes do not replace webhook authentication or payload validation.
- A request that works in curl can still fail in a browser because curl does not enforce CORS.
Common Mistakes
- Debugging CORS only with curl.
- Opening every origin instead of the specific app domain.
- Adding headers in both n8n and the proxy without checking duplicates.
- Confusing CORS with authentication.
Examples
Frontend origin: https://app.example.com
Webhook allowed origin: https://app.example.com
HTTP method: POST
Proxy preserves CORS headers: yes
Webhook execution created: yesFAQ
Why does curl work but my website fails?
Browsers enforce CORS. curl does not, so a successful curl request only proves the webhook is reachable.
Should I call n8n directly from frontend code?
Only for low-risk flows with validation and appropriate origin settings. Sensitive operations are usually better routed through a backend.