The browser blocked the request (CORS)
Your browser refused to read the response because the origin did not send an Access-Control-Allow-Origin header.
What it means
When a page fetches a URL on another domain, the browser only hands the response to the page if the server opts in with an Access-Control-Allow-Origin response header. Your stream origin did not send one, so the fetch failed before we could read a single byte. The stream itself is very likely fine.
Why it matters
This is a browser security rule, not a fault in the stream. It matters because it is also what stops a web player on your own site from playing the stream: a browser-based HLS or DASH player fetches manifests and segments under the same rule. If CORS is missing, the stream works in VLC and fails on the web.
How to fix it
- Use server mode here: our servers are not a browser, so CORS does not apply, and you get delivery diagnostics as well.
- Or paste the manifest text directly — that needs no fetch at all.
- To fix it properly, configure your CDN or origin to send Access-Control-Allow-Origin on manifests and segments. Most CDNs expose this as a one-line CORS policy.
- Allow the Range header too, which byte-range requests and DASH SegmentBase depend on.
Check your own stream
The free stream tester runs this check on every analysis and links each finding straight back here.
Open the stream tester →Frequently asked questions
- What does "The browser blocked the request (CORS)" mean?
- When a page fetches a URL on another domain, the browser only hands the response to the page if the server opts in with an Access-Control-Allow-Origin response header. Your stream origin did not send one, so the fetch failed before we could read a single byte. The stream itself is very likely fine.
- Why does it matter?
- This is a browser security rule, not a fault in the stream. It matters because it is also what stops a web player on your own site from playing the stream: a browser-based HLS or DASH player fetches manifests and segments under the same rule. If CORS is missing, the stream works in VLC and fails on the web.
- How do I fix it?
- 1. Use server mode here: our servers are not a browser, so CORS does not apply, and you get delivery diagnostics as well. 2. Or paste the manifest text directly — that needs no fetch at all. 3. To fix it properly, configure your CDN or origin to send Access-Control-Allow-Origin on manifests and segments. Most CDNs expose this as a one-line CORS policy. 4. Allow the Range header too, which byte-range requests and DASH SegmentBase depend on.
- How can I detect this automatically?
- Paste your stream delivery URL into StreamTest's free stream tester. It runs this check on every analysis, flags the finding, and links straight back to this page — no sign-up required.
Related Fetching and delivery checks
- The origin returned an error statusThe server answered with a 4xx or 5xx status instead of the manifest, so there was nothing to analyze.
- That address cannot be reached from our serversThe URL resolves to a private or reserved address, so we will not connect to it from the server. Local mode tests it from your own browser instead.
- That is not a valid URLThe address could not be parsed, so no request was attempted.
- That URL scheme is not supportedOnly http and https can be fetched; schemes such as rtmp, rtsp and file cannot.
- The URL redirected too many timesWe follow up to three redirects; this URL exceeded that.
- The response was too largeThe document exceeded the size limit for a single analysis.