CORS Headers Checker

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls how web pages can make requests to a different domain, protocol, or port than the one that served the page. Without CORS headers, browsers block cross-origin requests by default. If your API needs to accept requests from a frontend at a different domain, the API server must include the correct Access-Control-Allow-Origin header.

Access-Control-Allow-Origin tells the browser which origins are allowed to read the response. Setting it to * allows all origins but disables credentials. Setting it to a specific origin (e.g., https://yourapp.com) allows only that origin. If this header is missing or doesn't match the requesting origin, the browser blocks the response — even if the request succeeded on the server.

For 'non-simple' requests (non-GET/POST, custom headers, or content-type: application/json), browsers first send an OPTIONS preflight to check if the server permits the actual request. The server must respond with Access-Control-Allow-Methods and Access-Control-Allow-Headers. If the preflight fails, the actual request is never sent. Caching preflight responses with Access-Control-Max-Age reduces latency.

The CORS spec explicitly forbids using wildcard (*) with Access-Control-Allow-Credentials: true. When credentials (cookies, auth headers) are included in a cross-origin request, the browser requires the server to echo back the exact requesting origin — not *. Use a dynamic origin allowlist on the server instead: check the incoming Origin header and echo it back if it's on your whitelist.

By default, the browser only exposes a small set of response headers (like Content-Type) to JavaScript. Access-Control-Expose-Headers lists additional headers that should be accessible via response.headers.get() — for example, custom headers like X-Request-Id, X-Rate-Limit-Remaining, or Link for pagination. Headers not in this list are invisible to client-side code even if present in the response.

Nginx: add add_header Access-Control-Allow-Origin "https://yourapp.com"; to your server block. Express: use the cors() middleware (npm install cors) with the origin option. FastAPI: add CORSMiddleware with allow_origins. For dynamic origins, check the incoming Origin header against a whitelist and echo it back. Never use * in production APIs that handle authenticated requests.