Login Issue: CORS Policy & Preflight Redirect Error on auth.supabase.io

[RUI-com]

Hi Supabase Team,

I am currently unable to sign in to my account via the Supabase dashboard. The UI is displaying a "Failed to fetch (auth.supabase.io)" error message.

Upon inspecting the console, I found that the authentication request is being blocked due to a CORS policy violation related to a preflight redirect.

Here are the specific logs:

Access to fetch at 'https://auth.supabase.io/auth/v1/token?grant_type=password' from origin 'https://supabase.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.

POST https://auth.supabase.io/auth/v1/token?grant_type=password net::ERR_FAILED

Failed to load resource: the server responded with a status of 401 ()

I have attached a screenshot of the login screen error for your reference. Could you please check if there is an ongoing routing issue, outage, or misconfiguration with the auth API endpoints?

Looking forward to your prompt response.

Best regards,
Rawan

[ferdimsu]

Same issue here!

[zxsolution2022]

same. All my services are down...

[trikenaung-eng]

Same problem here.

[usernamewilsonisnotavailable]

same. i trust theyre solving it rn. https://status.supabase.com/

[tsaobee]

same issue here.

[Katya-qa917]

same problem.

[amasen02]

Root Cause

Under the W3C / Fetch CORS specification, HTTP redirects (301, 302, 307, 308) are strictly forbidden on CORS OPTIONS preflight requests. If an edge server, proxy, or firewall responds to an OPTIONS request with a redirect, the browser immediately aborts the network connection with:

Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.

When signing into supabase.com, the dashboard makes cross-origin fetch calls to auth.supabase.io. A redirect on this preflight almost always happens due to one of three reasons:

1. Cloudflare Bot Management / Managed Challenge (Most Common):
   auth.supabase.io sits behind Cloudflare. If your IP address temporarily acquires an elevated threat score (e.g. from shared VPN IPs, cellular networks, or rapid request bursts), Cloudflare intercepts the request to present a Managed Challenge / Turnstile verification. While normal page navigations show the verification widget, an asynchronous fetch preflight cannot render a challenge page and gets rejected as an illegal redirect.
2. Ad-Blockers, Privacy Extensions, or Brave Shields:
   Extensions like uBlock Origin, Privacy Badger, or Brave Shields sometimes rewrite or redirect cross-origin .io auth endpoints, causing the browser to abort the preflight.
3. Corporate Proxy / VPN SSL Interception:
   Corporate gateways (Zscaler, Palo Alto Networks, etc.) or Wi-Fi captive portals intercept unrecognized endpoints and redirect to authentication splash screens.

---

Step-by-Step Fixes

1. Pass the Edge Challenge Directly

Open a new browser tab and navigate directly to:

https://auth.supabase.io

If you are greeted by a Cloudflare "Verify you are human" Turnstile challenge, solve it once. This writes the necessary cf_clearance cookie for auth.supabase.io. Return to https://supabase.com/dashboard and log in again.

2. Test in Clean Incognito / Disable Content Blockers

• Disable Brave Shields (if using Brave browser) for supabase.com.
• Temporarily pause uBlock Origin / Privacy Badger.
• Open an Incognito / Private window without extensions and attempt the login.

3. Switch IP / Network

• If connected to a VPN or corporate proxy, disconnect or switch to a different egress server.
• If on home or mobile broadband, toggle airplane mode or restart your router to obtain a fresh IP address with a zero Cloudflare threat score.

4. Workaround: Use OAuth SSO or Magic Link

Password login relies on an in-page cross-origin fetch() to auth.supabase.io/auth/v1/token?grant_type=password. You can completely bypass CORS preflights by using full-window navigations:

• Click Sign in with GitHub or Sign in with Google.
• Alternatively, use Send Magic Link (passwordless email login), which authenticates via top-level URL token verification rather than client-side password preflight.