Skip to content
PPureDevKit

Tools/CORS

CORS

See if a browser would allow a cross-origin request.

Loading tool…

How to use CORS

  1. 1. Set the request Origin and method. What the page would send.
  2. 2. List extra headers. Authorization and Content-Type often trigger preflight.
  3. 3. Set response ACAO / ACAM / ACAH. From the API.
  4. 4. Read allow/block. Credentials cannot pair with *.

About this tool

CORS is enforced by browsers, not by curl. Simulating the policy locally is faster than redeploying nginx. This does not send OPTIONS anywhere.

Simple vs preflight

GET/POST with a few headers skip preflight. Authorization is not simple.

Credentials

Allow-Origin cannot be * if cookies or Authorization with credentials mode are used.

Code examples

Header

Access-Control-Allow-Origin: https://app.example.com

Frequently asked questions

Related tools

HTTP status

Look up status codes and common headers without leaving the tab.

Cookie builder

Compose Set-Cookie and Cache-Control directives.

cURL → Code

Paste a cURL command and get fetch, Axios, Python requests, and Go http.

All tools