Skip to content
Get a quote

Firebase Cloud FunctionsFirebase Cloud Functions: blocked by CORS policy

Your web app calls a Cloud Function and the browser console says the request was blocked by CORS policy. The function may work in Postman or curl, because only browsers enforce CORS. Here’s what Firebase’s docs say about each kind of function, and the fix, or hand it over at a fixed price.

Short answer

HTTP functions have no CORS policy by default, so browsers block calls from other sites. Set the cors option on the function to your app’s domains, or to true only for a public API. Callable functions allow all origins by default, so a CORS error there often means the request never reached your code: check the function name, region and deploy before touching CORS.

Why the browser blocks it, and the fix

  1. 01

    An HTTP function with no cors option

    “By default, HTTP functions don't have CORS configured, meaning that any cross-origin request to your function results in this error” Firebase, Call functions via HTTP requests

    An onRequest function rejects cross-origin calls from browsers unless you set cors. List the domains that should call it, such as your production domain and localhost while developing, rather than allowing every origin.

  2. 02

    cors set to true on a private endpoint

    “If your function should be openly available, for example if it's serving a public API or website, set the cors policy to true.” Firebase, Call functions via HTTP requests

    true lets any website call the function from a visitor’s browser. Keep it for endpoints that really are public, and check sign-in inside the function either way, since CORS only limits browsers.

  3. 03

    A callable function that fails before CORS

    “By default, callable functions have CORS configured to allow requests from all origins.” Firebase, Call functions from your app

    Callable functions already allow all origins unless you change it, so a CORS error can be a symptom of something else: a function name that doesn’t exist, a different region from the one the client calls, a function that didn’t deploy, or a crash. Check the function logs and the region in your client code.

Checked against the vendor’s docs on : Firebase docs: Call functions via HTTP requests (CORS); Firebase docs: Call functions from your app (callable).

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Related: Supabase Edge Function CORS error · Firebase auth/unauthorized-domain · Firebase App Check blocking requests

Questions

More on this error

Why does it work in Postman but not in the browser?

CORS is a browser rule. Postman, curl and servers don’t apply it, so a function can answer them and still be blocked when your web app calls it.

Does setting cors protect my function?

No. It only controls which websites a browser lets call it. Unless you’ve restricted who may invoke the function, anything outside a browser can still call it, so check who the user is inside the function for anything private.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.

Describe your problem All fixes