Skip to main content

How to handle "event submission rejected with_reason: Cors" errors

Issue

Events from my browser SDK return HTTP 403 with this response body, and I need to stop Sentry from rejecting them as a disallowed domain:

{"detail":"event submission rejected with_reason: Cors"}

Applies To

  • All SaaS Customers and Self-Hosted Users

  • Allowed Domains

  • Browser SDKs

Resolution

This response means Sentry rejected the event at ingest because the request Origin or Referer header does not match your project’s Allowed Domains list. It is not a browser CORS failure on your own API.

Sentry checks Origin first, then Referer if Origin is missing. Requests with neither header are accepted. That pattern is common for server SDKs and direct API submissions.

Rejected requests appear as Disallowed Domain in Stats. For background, see Allowed Domains.

To fix the rejection:

  1. Open your browser’s network tools.

  2. Load a page in your app that triggers the 403 response to Sentry.

  3. Open the failed store or envelope request to Sentry.

  4. In the request headers, copy the domain from Origin. If Origin is missing, use Referer.

  5. In Sentry, go to Settings → Projects → [your project] → Project Settings.

  6. Under Client Security, open Allowed Domains.

  7. Add that domain on its own line. Examples that work include https://example.com, example.com, and *.example.com.

  8. Save the setting, then trigger the event again and confirm the 403 is gone.

If Allowed Domains is only *, Sentry accepts all origins. A Cors rejection means the list was narrowed and the sending page’s origin is not on it.

Related Articles
Did this answer your question?