CORS Header Generator

For a fully public API (no credentials): Access-Control-Allow-Origin: *, Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS, and Access-Control-Allow-Headers for any custom headers. Add Access-Control-Max-Age to cache the preflight response. Never use * with credentials.

Browsers send an OPTIONS preflight before non-simple cross-origin requests. Access-Control-Max-Age tells the browser how long (in seconds) to cache the preflight result, avoiding repeated OPTIONS requests. A value of 86400 (24 hours) is common for APIs that rarely change their CORS policy.

The CORS spec allows only one origin value per response (or *). To support multiple origins, check the incoming Origin header against a server-side allowlist and reflect it back if it matches. This tool generates the headers for a single origin — implement allowlist logic in your server code.

Access-Control-Allow-Headers lists which request headers browsers can send (checked during preflight). Access-Control-Expose-Headers lists which response headers JavaScript can read via fetch response.headers.get(). By default, only a small set of 'safe' response headers are readable.

Preflight (OPTIONS) is triggered when: the method is PUT/DELETE/PATCH, the Content-Type is application/json (or anything other than form types), or custom headers like Authorization are sent. GET with only standard headers is 'simple' and doesn't require a preflight.