🔒

CORS Tester

Test CORS headers on any URL. Sends a real preflight OPTIONS request and inspects Access-Control headers from the browser.

Origin to simulate:

With Credentials

What is CORS?

CORS (Cross-Origin Resource Sharing) is a browser security feature that restricts HTTP requests made from scripts to a different domain than the one that served the script.

When a browser makes a cross-origin request, it first sends an OPTIONS preflight to check if the server allows it. The server must respond with the correct Access-Control-* headers.

About CORS Tester

This tool sends an HTTP OPTIONS preflight request to any URL you specify and displays the full set of Access-Control response headers returned by the server. It checks for the presence and values of Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Max-Age, giving you a clear pass/fail verdict for each.

Cross-Origin Resource Sharing errors are one of the most common sources of confusion when integrating frontend apps with APIs. This tester saves you from digging through browser network panels by surfacing exactly which CORS headers are present, missing, or misconfigured on any endpoint.

Common Use Cases

Verifying that a backend API endpoint has correctly configured Access-Control-Allow-Origin before wiring up a frontend
Debugging a "CORS policy blocked" error in a browser console by pinpointing exactly which header is absent
Confirming that a third-party API allows the HTTP method (PUT, DELETE) and custom headers your app needs to send
Testing staging vs. production API servers to ensure CORS configuration was deployed consistently

How to Use

Enter the full URL of the API endpoint you want to test (include the protocol: https://)
Select the HTTP method your app will actually use (GET, POST, PUT, DELETE, etc.)
Click "Test CORS" — the tool sends an OPTIONS preflight request and reads the response headers
Review each row in the result panel for a pass/fail check and the exact header value returned

Frequently Asked Questions

Why does CORS only affect browser requests, not curl or Postman?

CORS is a browser security mechanism — the browser enforces cross-origin restrictions on behalf of the user. Command-line tools like curl and API clients like Postman send requests directly from your machine, so they are not subject to the same-origin policy and will succeed even when a browser would block the same request.

What is a CORS preflight request?

A preflight is an automatic OPTIONS request sent by the browser before certain cross-origin requests (those that use non-simple methods or custom headers). The server must respond with the appropriate Access-Control headers to grant permission, otherwise the browser blocks the actual request from going through.

Will this tool work for APIs that require authentication?

It tests the CORS preflight response, which the server must handle before authentication is checked. If the server returns proper Access-Control headers on the OPTIONS request, the CORS test will pass regardless of whether your auth token would be valid on the actual request.