CORS Tester
Online CORS tester for cross-origin request checks, response header analysis, preflight diagnostics, and server config generation
This tool sends requests directly from your browser to the target URL to inspect CORS policy and response headers.
CORS Request Test
Result
CORS Config Generator
Config Snippet
const http = require('http')
http.createServer((req, res) => {
res.setHeader('Access-Control-Allow-Origin', 'https://example.com')
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization')
res.setHeader('Access-Control-Max-Age', '3600')
if (req.method === 'OPTIONS') {
res.writeHead(204)
res.end()
return
}
res.writeHead(200)
res.end('OK')
}).listen(3000)Documentation
CORS tester helps verify cross-origin access, inspect key response headers, and generate server config snippets for API debugging, pre-release checks, and go-live verification.
How to Use
- Enter target URL, choose request method, and optionally provide custom headers/body.
- Click Test CORS and review status, timing, CORS headers, and diagnostics.
- Tune policy fields in the generator and produce server config snippets.
- Apply generated settings on server and retest until diagnostics are clean.
Common CORS Errors and Fixes
No 'Access-Control-Allow-Origin' header
Response does not declare allowed origin.
Return Access-Control-Allow-Origin from server with the correct domain value.
Method is not allowed by Access-Control-Allow-Methods
Preflight passes but target method is not allowed.
Add your request method to Access-Control-Allow-Methods.
Request header field is not allowed
Custom header is missing in allowed header list.
Add corresponding header names to Access-Control-Allow-Headers.
Credentials is true but origin is *
Credential mode conflicts with wildcard origin.
Use a specific origin instead of * when credentials are enabled.
Best Practices
- Avoid Allow-Origin=* in production and use strict origin whitelists.
- Expose only required methods and headers to reduce attack surface.
- Use suitable max-age to balance performance and policy update latency.
- Cross-check browser console errors with response headers for faster diagnosis.