Safari Fetch API Failure Due to CORS with Supabase // Syntropic Solution

### Discussed in https://github.com/orgs/supabase/discussions/19983



^{Originally posted by **asyncink** December 23, 2023}
Hello! 

We are facing errors in Safari which are not reproduced in 100% cases, but are definitely on Supabase side and are reproduced consistently in Safari browser. Safari makes preflight request (OPTIONS) when interacting with Supabase API. And for some reason, that we can not clearly figure out on our side, these requests

This issue arises when Safari fails to successfully complete CORS preflight checks for requests made to Supabase's API. The root of the problem is usually the lack of proper CORS headers being sent back by the server in response to the preflight (OPTIONS) request.

To resolve the issue, ensure the Supabase instance is configured to return the appropriate CORS headers, allowing requests from the origin of your client application. Update the Supabase Edge Function headers as follows:

app.use((req, res, next) => {   res.setHeader('Access-Control-Allow-Origin', 'https://YOUR_CLIENT_ORIGIN');   res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');   res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With,content-type, Authorization');   res.setHeader('Access-Control-Allow-Credentials', true);   next(); });

Ensure the client-app making requests to Supabase carries the appropriate headers and ensure that your Supabase instance allows requests from your client-app's origin:

fetch('https://your-instance.supabase.co/rest/v1/resource', {   method: 'GET',   headers: {     'Accept': 'application/json',     'Content-Type': 'application/json',     'Authorization': 'Bearer YOUR_ACCESS_TOKEN',     'Origin': 'https://your-client-origin.com'   } })

Also check your Supabase settings for allowed origins to ensure that Safari is covered, and tests in different environments such as Safari on macOS and iOS are conducted to verify resolution.

Safari Fetch API Failure Due to CORS with Supabase

🤝 It's a gift. Gift something back.