CORS Header Tester

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that restricts JavaScript from making requests to a different origin (domain, protocol, or port) than the page it loaded from. Servers must explicitly opt in by returning Access-Control-Allow-Origin and related headers. If they don't, the browser blocks the response — even if the server processed the request successfully.

Before sending certain cross-origin requests (non-simple methods like PUT/DELETE, or custom headers), the browser sends an OPTIONS preflight request to ask the server if the actual request is allowed. The server must respond with appropriate Access-Control headers. If the preflight fails or returns wrong headers, the browser blocks the real request. GET and POST with standard content types are usually simple requests that don't trigger preflights.

CORS errors happen on the browser side — the server may have processed the request and returned 200, but if the response is missing Access-Control-Allow-Origin (or it doesn't match your origin), the browser blocks JavaScript from reading the response. The network tab shows 200, but your code gets a CORS error. The fix is always on the server side: add the correct CORS headers.

Wildcard (*) allows any origin to read the response — fine for public APIs with no authentication. A specific origin (e.g. https://yourapp.com) restricts access to that domain. You cannot use * with Access-Control-Allow-Credentials: true — if you need cookies or auth headers in cross-origin requests, you must specify the exact origin and set Vary: Origin in the response.

Install the 'cors' npm package and add it as middleware: `app.use(cors({ origin: 'https://yourapp.com', credentials: true }))`. For development, you can use `origin: true` to mirror the request origin. Never use `origin: '*'` with credentials. Always whitelist specific origins in production.

No — CORS headers must be set by the server. Frontend workarounds include: using a proxy (Nginx, Next.js rewrites, or a CORS proxy service) that forwards requests and adds headers, or configuring your dev server to proxy requests. In production, the correct fix is always to configure the target server or API to return the right Access-Control headers.