CORS Policy Tester

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that restricts how web pages can request resources from a different origin (domain, protocol, or port) than the one that served the page. The browser enforces this to protect users — without CORS, a malicious page could silently make requests to your bank or email using your existing session cookies. CORS headers on the server tell the browser which cross-origin requests are safe to allow. Note: CORS is enforced by the browser only; it does not protect your server from direct requests (e.g., from curl or server-to-server calls).

A preflight request is an automatic OPTIONS request the browser sends before a 'non-simple' cross-origin request. Simple requests are GET/POST with only basic headers (Content-Type: text/plain, etc.). Any request with custom headers, Content-Type: application/json, or methods like PUT/DELETE/PATCH triggers a preflight. The browser sends OPTIONS to the target URL asking if the actual request is permitted. The server must respond with the correct Access-Control-Allow-* headers. If the preflight fails, the browser never sends the actual request.

No. This is one of the most common CORS mistakes. If Access-Control-Allow-Credentials is set to 'true', the browser requires Access-Control-Allow-Origin to be an explicit origin (not the wildcard *). Using * with credentials=true causes the browser to block the request. You must echo back the specific requesting origin in Access-Control-Allow-Origin. Also, the requesting code must explicitly set credentials: 'include' in the fetch call. This pairing requirement exists to prevent credential-bearing requests from being inadvertently allowed to any origin.

Access-Control-Max-Age tells the browser how many seconds to cache the result of a preflight OPTIONS request. During this time, the browser will skip sending another OPTIONS request for the same URL+method+headers combination and allow the actual request directly. A value of 86400 (24 hours) is common for production. Without this header, the browser uses a short default (typically 5 seconds in Chrome), which means a preflight is sent for every unique cross-origin request, adding latency. Setting a long max-age reduces this overhead significantly for high-frequency API calls.