CORS Tester
Test Cross-Origin Resource Sharing headers for any API endpoint. See allowed origins, methods, and headers with fix suggestions.
Headers to include in the preflight check
Tests from origin … — this is your actual browser origin and cannot be spoofed.
Related Tools
You might also find these useful
Everything you need to know
Understanding CORS
Cross-Origin Resource Sharing is a critical web security mechanism implemented by browsers. When a web page tries to make an HTTP request to a different domain (cross-origin), the browser checks if the target server permits the request by looking for specific CORS headers in the response. Without these headers, the browser blocks the response entirely, even if the server processed the request successfully.
How This Tool Works
Enter a URL and HTTP method, then click "Test CORS" to send a request from your browser. The tool examines the response headers and displays all CORS-related headers returned by the server, including Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, and more. If the request is blocked, you'll see the error message with suggestions for fixing it.
Common CORS Scenarios
CORS issues frequently arise when building single-page applications that call APIs on different domains, integrating third-party APIs, loading web fonts or scripts from CDNs, or using WebSocket connections to different origins. The most common fix is configuring the correct Access-Control-Allow-Origin header on the server.
CORS Headers Reference
The key CORS headers are: Access-Control-Allow-Origin (specifies allowed origins), Access-Control-Allow-Methods (allowed HTTP methods), Access-Control-Allow-Headers (allowed request headers), Access-Control-Allow-Credentials (whether cookies are allowed), and Access-Control-Max-Age (preflight cache duration). Our guide tab provides detailed explanations and examples for each.
Related Developer Tools
Check your API responses with the API Tester, generate security headers with the CSP Header Generator, or test JWT tokens with the JWT Decoder.