#api

"Blocked by CORS policy": what the browser is really refusing, and how to fix it on the server

Fix "has been blocked by CORS policy: No Access-Control-Allow-Origin header": why it happens, the fix on the server or in Nginx, preflight requests, and cookies.

Intermediate · 4 min read

jwt expired

Security

JWT "jwt expired" and "invalid signature": how to find out what is wrong with a token

Fix JWT "jwt expired" and "invalid signature": read the exp claim, check clock differences, the secret, HS256 vs RS256 and rotated keys, without turning verification off.

Intermediate · 5 min read