How to use the CORS Header Generator & Tester
- On Generate headers, list the origins that may call your API (or allow any), tick the methods, and enter the request headers your front end sends — usually
Content-TypeandAuthorization. - Tick Allow credentials only if the browser must send cookies or an Authorization header with
credentials: 'include'. - Pick your platform and copy the code — Express, Nginx, Apache, Netlify, Vercel, Next.js, Workers or PHP.
- Deploy, then switch to Test a URL: enter the API URL and the page’s origin to see whether the preflight and the real request would pass.
Why browsers block requests
A page on https://app.example.com can only read a response from https://api.example.com if the API says so with CORS headers. For anything beyond a simple GET or form POST — JSON bodies, Authorization headers, PUT or DELETE — the browser first sends a preflight: an OPTIONS request asking “may this origin use this method and these headers?”. If the answer is missing or wrong, you see “has been blocked by CORS policy” and your code never gets the response.
| Header | What it must contain |
|---|---|
Access-Control-Allow-Origin | The calling origin exactly, or * (not allowed with credentials) |
Access-Control-Allow-Methods | The method of the real request (preflight only) |
Access-Control-Allow-Headers | Every non-standard request header, such as Authorization or Content-Type: application/json |
Access-Control-Allow-Credentials | true when cookies or credentials are sent |
Access-Control-Max-Age | How long the browser may cache the preflight answer |
Vary: Origin | Needed when the allowed origin changes per request, so caches don’t serve one origin’s answer to another |
How the tester works
Our server sends the request with an Origin header and, if the browser would need one, an OPTIONS preflight with Access-Control-Request-Method and -Headers — the same as Chrome or Firefox. It then checks the answer against the CORS rules browsers apply. Servers that only allow certain IP addresses or need cookies may answer differently for real users. Related: HTTP Header Checker, API Tester, Security Headers Checker.
Also searched as: cors header generator, cors tester, cors checker, blocked by cors policy, access-control-allow-origin, cors preflight test, express cors, nginx cors.
Tools that pair well with the CORS Header Generator & Tester
- CSP Generator — Pick what your site loads — scripts, styles, images, fonts, analytics, embeds — and get a Content-Security-Policy that allows exactly that, with warnings for risky settings.
- cURL to Code — Paste a curl command — from API docs or “Copy as cURL” in your browser’s DevTools — and get ready-to-run code for six languages, with headers, body and authentication carried over.
- Email Header Analyzer — Paste the raw headers of an email to see its whole journey: every server hop with the time it took, the SPF, DKIM and DMARC results, the originating IP, and warning signs like a mismatched Reply-To or Return-Path.
- MIME Type Lookup — Search 200+ file extensions and MIME types — .webp, .woff2, .webmanifest, application/wasm … — or drop a file to detect its real type from its first bytes.