# X_CORS_CONFIG_INVALID

## Means

the cors config can never produce a working response

## Typical cause

`cors.origins` contains `'*'` while `cors.credentials` is true — a pair no browser accepts, which used to resolve to no CORS headers at all rather than an error — or contains `'null'`, the origin every sandboxed iframe sends, which `URL.parse('localhost:3000').origin` produces

## Fix

call `configureHttp({ cors: { credentials: false } })` at module scope in a file under `apps/*/`, or replace `origins: ['*']` with the exact origins allowed to call this app; for `'null'`, list the scheme: `configureHttp({ cors: { origins: ['http://localhost:3000'] } })`

[HTTP](/error-codes#http)