You built an API. You tested it with curl and every endpoint answered perfectly. Then you pointed a front end at it and got this: Access to fetch at 'http://localhost:8080/api/login' from origin 'http://localhost:5173' has been blocked by CORS policy: Response to preflight request doesn't pass access control check. Nothing is broken. Your API is fine. curl was never the test. I hit this building a Vue front end for a Go helpdesk API, so here is what is actually happening and ...