CORS Configuration Check

The CORS Configuration Check sends real requests to a URL to see whether it allows browser requests from another origin. It surfaces the server's Access-Control-Allow-Origin, -Methods, -Headers and -Credentials response headers verbatim and grades what they mean as normal, caution, or risky. It's the fastest way to narrow down the cause of the “has been blocked by CORS policy” error you see when calling an API from JavaScript.

Enter the API URL to check and the origin you'd send the request from. The server issues a simple GET request and an OPTIONS preflight request and collects the response headers. Leave the origin blank to test with the default https://example.com. Headers are read server-side rather than in a browser, so no actual data is fetched, and results are briefly cached for speed.

How CORS works

When JavaScript makes a request to an origin different from its own, the browser only hands the response back to the script if the response carries the right Access-Control headers. If they're missing or the origin doesn't match, the network response may arrive but the browser blocks the script from reading it.

• Access-Control-Allow-Origin: the origin allowed — a specific URL, a wildcard (*), or the requesting origin reflected back.
• Access-Control-Allow-Methods: HTTP methods permitted by the preflight.
• Access-Control-Allow-Headers: custom request headers that are allowed.
• Access-Control-Allow-Credentials: whether cookies and auth credentials may be sent along.

Preflight vs. simple requests

Simple requests like GET are sent directly, but requests with custom headers or methods like PUT and DELETE trigger an OPTIONS preflight first, where the browser asks whether the call is allowed. This tool sends both, evaluating the preflight response headers first and falling back to the simple response when they're absent.

The danger of * with credentials

A configuration that sets Access-Control-Allow-Origin to * (wildcard) while also allowing credentials is dangerous. The spec forbids combining a wildcard with credentials, but a server that blindly reflects the request origin and still allows credentials effectively lets any site call your API using the user's cookies. Only allow trusted origins explicitly. To inspect the rest of the response headers beyond CORS, view the full set with the HTTP header checker.

CORS response header reference

Match the header values in your result against the table below to read them at a glance. The same header can be normal, caution, or risky depending on its value.

A real check, walked through

Say origin https://app.example.com makes a PUT request (with a custom Authorization header) to https://api.example.com/users. The browser sends an OPTIONS preflight first. The call passes if the server responds like this:

• Access-Control-Allow-Origin: https://app.example.com — my origin reflected exactly
• Access-Control-Allow-Methods: GET, PUT, DELETE — PUT is included
• Access-Control-Allow-Headers: Authorization, Content-Type — the header I send is allowed
• Access-Control-Allow-Credentials: true — needed when cookies are sent
• Access-Control-Max-Age: 600 — caches the preflight result for 600s (fewer repeat OPTIONS)

If PUT is missing from Allow-Methods, or Authorization is missing from Allow-Headers, the browser never sends the real request and logs “Method PUT is not allowed” or “Request header field authorization is not allowed by Access-Control-Allow-Headers.” Because this tool shows the preflight's Methods and Headers separately, you can tell immediately which one is missing.

Common pitfall

• “It works in curl, so why is it blocked?” — CORS is enforced only by browsers. curl, Postman, and server-to-server calls are never blocked, so a tool that “works” doesn't prove CORS passes.
• A trailing slash, a comma-separated list, or a missing port in Allow-Origin will fail to match. The value must be exactly one origin (scheme://host:port); https://app.example.com,https://x.com is invalid.
• Error responses like 403/500 usually carry no CORS headers, so an auth failure shows up in the console only as “blocked by CORS.” Check the status code first.