CORS errors around localhost:5173

Which error you actually have

Two different problems get called "a CORS error", and they need opposite fixes.

• Your app on 5173 calls a backend elsewhere, and the backend rejects it. The backend decides — or you sidestep it with a dev server proxy.
• Something else calls the Vite dev server on 5173 and gets rejected. That is server.cors, and it is the case below.

The default

Requests from localhost, 127.0.0.1 and ::1 are accepted, on any port. Everything else is not. This used to be permissive and was tightened, because a dev server that answers any origin will hand your source code to any page you happen to have open.

{ origin: /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/ }

Allowing one more origin

Name it. The option takes the same shape as the cors middleware everyone already knows.

export default defineConfig({
  server: {
    cors: {
      origin: ['https://studio.example.com'],
    },
  },
})

Not true

cors: true accepts every origin. Any page in your browser can then read from your dev server — source, env values, whatever it serves. It is the same class of mistake as allowedHosts: true, and it appears in the same forum answers.

The case that needs no CORS at all

If your frontend calls your own backend, route it through the dev server instead. Same origin, no preflight, no headers to negotiate — and nothing to undo before deploying.

server: {
  proxy: { '/api': 'http://localhost:8080' },
}

• How the Vite dev server handles requests to and from localhost:5173Three settings cover three different requests: server.proxy forwards a request from 5173 to your backend, server.cors decides which origins may read a response from 5173, and server.allowedHosts decides which hostnames may reach 5173 at all.
• Proxying API requests from the Vite dev serverserver.proxy forwards any request whose path starts with a given prefix to another server, so the browser only ever talks to localhost:5173 and no CORS error appears.
• Blocked request. This host is not allowed.The Vite dev server only answers to localhost, hostnames ending in .localhost, and IP addresses — every other hostname has to be listed in server.allowedHosts.
• localhost:5173 — the port itselfWhat the address means, common dev ports, and the autocomplete fix.