# CORS error in the browser console
Services: fe-b2g, fe-gmarket, fe-website, fe-filems, fe-nibe; kong · Owner: frontend lead

## Symptom
Console: `Access to XMLHttpRequest at 'https://<other-host>/...' from origin '<this-host>' has been
blocked by CORS policy`.

## Confirm it is this
Every platform call should be **same-origin** (one Kong behind one ALB), so a CORS error almost
always means a request **escaped its environment**. Compare the host in the blocked URL with the
page's own host. If they differ, it's a hardcoded hostname, not a CORS misconfiguration.
- Check `https://<site>/<app>/assets/env.js`. It is generated at container start from the task
  definition's `MICROFE_HOST`, and must not name another tier.
- Grep the app source for platform hosts outside `src/environments/environment.*.ts`. The exact
  command is in `docs/frontend-endpoint-rules.md` §5.

## Fix
- Wrong `MICROFE_HOST` on the task definition: fix the env var and force a new deployment. No
  rebuild needed.
- Hostname compiled into the bundle: make it relative in `environment.*.ts` and redeploy.
- "multiple values" in `Access-Control-Allow-Origin` means two layers add the header. Keep the
  application/Kong one and remove the web-server one.

Don't "fix" it by allowing the origin. That would let one tier read and write another tier's data.

## Prevent
`docs/frontend-endpoint-rules.md`, the `frontend-endpoint-rules` skill, eval case
`evals/cases/04-hardcoded-gateway-url.md`.