CORS Policy Builder

CORS (Cross-Origin Resource Sharing) is a browser security policy that blocks web pages from making requests to a different domain, protocol, or port unless the server explicitly allows it. If your API at api.example.com needs to accept requests from a frontend at app.example.com, you must add CORS headers to your API responses. Without them, browsers will block the response even if the request reached your server.

Simple requests (GET, POST with standard content types) are sent directly with the origin header. Non-simple requests (PUT, DELETE, custom headers, JSON content-type) trigger a preflight: the browser first sends an OPTIONS request to check if the server permits the actual request. Your server must respond to the OPTIONS request with Access-Control-Allow-Methods and Access-Control-Allow-Headers, or the actual request will never be sent.

The CORS spec explicitly prohibits this combination. When a request includes credentials (cookies, Authorization headers), the browser requires the server to echo back the exact requesting origin — not a wildcard. Using * with credentials: true is a security risk (any site could make credentialed requests), so browsers reject it. Use an origin allowlist and dynamically echo back the requesting origin if it's on the list.

Access-Control-Max-Age tells the browser how many seconds to cache the preflight response. While the preflight is cached, the browser skips the OPTIONS request for subsequent requests to the same endpoint from the same origin. The default (if omitted) is 5 seconds in most browsers. Increase it (e.g., 3600 = 1 hour, 86400 = 24 hours) to reduce preflight latency for frequently-called APIs.

You can't list multiple values in Access-Control-Allow-Origin — it only accepts a single origin or *. To support multiple specific origins, check the incoming Origin header in your server code against a whitelist, then echo back the matching origin. This tool generates that pattern for Express, FastAPI, Django, and other frameworks automatically.

Common issues: 1) Your CDN or reverse proxy (Nginx, Cloudflare) strips or overrides CORS headers — add headers at the proxy layer too. 2) The preflight OPTIONS request isn't being handled (add a route or middleware for it). 3) You're allowing * but the request includes credentials. 4) You forgot to include the specific Content-Type or Authorization in Access-Control-Allow-Headers. 5) Your server is returning a 4xx/5xx error before the CORS middleware runs — CORS headers are still needed on error responses.