CORS Header Analyzer

The key headers are: Access-Control-Allow-Origin (which origins can read the response), Access-Control-Allow-Methods (which HTTP methods are permitted), Access-Control-Allow-Headers (which request headers are allowed), Access-Control-Allow-Credentials (whether cookies/auth are permitted), and Access-Control-Max-Age (how long preflight results can be cached). Paste your response headers here and this tool shows what each one means and whether your request would be allowed.

Wildcard (*) means any origin can read the response. This is appropriate for public APIs (CDN assets, open data APIs) but dangerous for APIs that return user-specific data. Crucially, * cannot be combined with Access-Control-Allow-Credentials: true — the browser will block the request with a CORS error. For credentialed requests, the server must echo back the specific requesting origin.

Several gotchas: (1) The header value doesn't match your origin exactly — scheme, host, and port must all match. (2) You're using credentials (cookies, Authorization header) with a wildcard origin. (3) The server is only sending CORS headers for OPTIONS preflight, not for the actual request. (4) Your server framework strips headers on error responses. (5) A CDN or proxy is stripping CORS headers before they reach the browser.

For 'non-simple' cross-origin requests — those using methods other than GET/POST/HEAD, or custom headers like Authorization or Content-Type: application/json — browsers first send an HTTP OPTIONS request to ask the server what it permits. The server must respond with Access-Control-Allow-Methods and Access-Control-Allow-Headers. If the preflight fails or is missing required headers, the actual request is never sent.

Access-Control-Max-Age tells the browser how many seconds to cache the preflight result. Without it (or with a low value), the browser sends an OPTIONS preflight before every cross-origin request. With a high value (e.g., 86400 = 1 day), the browser skips the preflight for subsequent requests to the same endpoint. This eliminates the round-trip latency of the OPTIONS request for repeat callers.

By default, JavaScript can only read a small set of 'safe' response headers (like Content-Type and Cache-Control). Access-Control-Expose-Headers explicitly whitelists additional headers for JavaScript access. This is commonly needed for pagination (Link header), rate limiting (X-Rate-Limit-Remaining), request tracing (X-Request-Id), and API versioning headers. Without it, response.headers.get('x-request-id') returns null even if the header is present.