客户端JavaScript能否将Origin头设为*以解决API跨域CORS问题？

Great question—let’s break this down clearly:

1. 能不能在客户端JavaScript中将Origin头设置为'*'？ #

Short answer: No, you can’t. Here’s why:

• The Origin request header is automatically set by the browser, not your JavaScript code. Its value is the origin (protocol + domain + port) of the page your script is running on.
• Browsers treat Origin as a protected header—you can’t manually override it to * (or any other value) via frontend JS. Even if you try to add it in fetch or XMLHttpRequest options, the browser will ignore your setting and send the actual origin of your page, or throw an error.
• This is a core security feature of the same-origin policy, designed to prevent malicious sites from faking their origin to access restricted APIs.

2. 解决你遇到的CORS错误 #

First, let’s look at your error message:

Failed to load https://: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://’ is therefore not allowed access.

This error means the API server isn’t configured to allow requests from your frontend origin. The fix has to happen on the server side—there’s no way to bypass this from the client:

• The server needs to add the Access-Control-Allow-Origin header to its responses. You can set it to your specific frontend origin (e.g., http://your-frontend-url.com) to restrict access, or * if you want to allow all origins (note: * won’t work if your request includes credentials like cookies or HTTP auth—you’ll need to specify the exact origin in that case).
• If your request triggers a preflight OPTIONS request (common for requests using PUT/DELETE methods, or custom headers), the server also needs to handle OPTIONS requests and return additional CORS headers like Access-Control-Allow-Methods and Access-Control-Allow-Headers to approve the request.

If you don’t control the API server, your next best option is to use a proxy server:

• Set up a simple backend server (e.g., Node.js, Python) that acts as a middleman. Your frontend sends requests to your proxy, which then forwards the request to the target API. Since server-to-server requests aren’t subject to the same-origin policy, this avoids the CORS error.

内容的提问来源于stack exchange，提问作者Mitch