Access CORS preflight fails with 403 even when you are logged in

TL;DR

If your frontend behind Cloudflare Access fails CORS preflight with 403, go to Zero Trust, Access controls, Applications, open the app, then Advanced settings and CORS settings, and enable Bypass options requests to origin.

Steps

1. If your frontend behind Cloudflare Access fails CORS preflight with 403, go to Zero Trust, Access controls, Applications, open the app, then Advanced settings and CORS settings, and enable Bypass options requests to origin. Make sure your origin enforces the Access JWT on the real requests, since Access no longer guards OPTIONS. Alternatives are having Cloudflare respond to the preflight, or a Worker that injects the auth token when both sides are behind Access.

When to use

You are seeing this: Make sure your origin enforces the Access JWT on the real requests, since Access no longer guards OPTIONS. Use this skill when you run into "Access CORS preflight fails with 403 even when you are logged in".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (CORS, Cloudflare One): documents a gotcha that trips agents putting a browser app behind Cloudflare Access. A preflighted cross-origin request gets a 403 on the OPTIONS call even when the user is logged in, because browsers never include cookies with OPTIONS requests by design, so Access cannot see the session. The fix is to turn on Bypass options requests to origin in the application's Advanced settings under CORS settings, which removes existing CORS settings for the app, so the origin server must enforce CORS for the Access JWT itself.

Verified resolution: If your frontend behind Cloudflare Access fails CORS preflight with 403, go to Zero Trust, Access controls, Applications, open the app, then Advanced settings and CORS settings, and enable Bypass options requests to origin. Make sure your origin enforces the Access JWT on the real requests, since Access no longer guards OPTIONS. Alternatives are having Cloudflare respond to the preflight, or a Worker that injects the auth token when both sides are behind Access.

Source URL: https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/cors/