CORS Tester

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that restricts web pages from making requests to a different origin (domain, protocol, or port) than the one that served the page. Browsers enforce this to prevent malicious scripts from accessing sensitive data on other sites. The server must explicitly permit cross-origin requests by sending the correct Access-Control-Allow-Origin header.

A preflight request is an HTTP OPTIONS request that browsers send automatically before certain cross-origin requests — specifically those using methods other than GET/POST, or custom headers. The server must respond with the correct Access-Control headers to signal that the actual request is allowed. If the preflight fails, the browser blocks the real request entirely.

When you send credentials (cookies, HTTP auth, or client-side certificates), browsers require Access-Control-Allow-Origin to be an explicit origin, not a wildcard (*). Additionally, the server must include Access-Control-Allow-Credentials: true. Using * with credentials is explicitly forbidden by the CORS spec — the browser will reject the response even if the server sends both.

Add the correct Access-Control-Allow-Origin header to your API responses. For public APIs, use *. For credentialed requests, reflect the requesting origin dynamically. For preflight support, also handle OPTIONS requests and return Access-Control-Allow-Methods and Access-Control-Allow-Headers. Most frameworks have CORS middleware: Express (cors package), FastAPI (CORSMiddleware), Django (django-cors-headers), etc.

The minimum is Access-Control-Allow-Origin. For full functionality: Access-Control-Allow-Methods (e.g. GET, POST, PUT, DELETE, OPTIONS), Access-Control-Allow-Headers (e.g. Content-Type, Authorization), Access-Control-Allow-Credentials: true (if using cookies), Access-Control-Expose-Headers (for custom response headers your client needs to read), and Access-Control-Max-Age (cache duration for preflight results, e.g. 86400 for 24 hours).

Localhost URLs (http://localhost:*) are not reachable from external servers or most proxy-based testing tools. This tester sends requests directly from your browser, so localhost URLs work fine as long as the target server is running on your machine. No proxy is involved — your browser makes the actual cross-origin request.