⌘ K
cors · headers · preflight · live

Build CORS response headers

Compose Access-Control-* headers for a policy. Choose origin, methods, credentials and preflight cache age. All assembly runs locally.

CORS Headers Builder
Origin
scoped
single
Methods
3
verbs
Credentials
off
anon
Max-Age
3600
preflight
Allow-Methods
input · policy
output · headers
Length: 184 B
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 3600
Quick Start

How to build CORS headers

CORS headers let a browser script call cross-origin endpoints. Compose them on the server side; preflight requests verify the policy before the real call.

  1. 01

    Pick an origin

    Echo the calling origin per request, or hard-code a single trusted one.

    Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.

    originIANAregistryofflinelive
    origin · queryscoped · IANA
    Access-Control-Allow-Origin: https://app…
    loaded · IANA bundlespec · ready
  2. 02

    Allow methods

    List verbs your endpoint accepts. Browsers preflight non-simple methods.

    Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.

    methodsRFC 9110canonicalspec-compliantlive
    methods · options3 · live
    Allow-Methods: GET, POST, PUT
    options applied · livecanonical
  3. 03

    Tune preflight

    Set max-age so browsers cache the preflight result and skip repeats.

    Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.

    max-agevalidationlintpitfallslive
    max-age · looked up1h · ready
    Max-Age: 3600
    result · livevalidated
  4. 04

    Credentials caveat

    Setting Allow-Credentials forces a specific origin — wildcards are rejected.

    Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.

    safeclipboardMIME-correctblobcurl-ready
    ok · copiedready · done
    Allow-Credentials: true
    shipped · ready to shipsuccess
Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Related toolsCORS TesterCSP BuilderHeaders AnalyzerHTTP HeadersRequest BuilderCache-Control
Use Cases

When to set CORS

SPAs calling APIs, embedded widgets, third-party fetches.

SPA + API

Frontend hosted on a different origin than the API. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Embedded widget

Customer sites fetch your widget assets cross-origin. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Public API

Allow browser apps to call your endpoints directly. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Auth flows

Allow-Credentials lets cookies flow across origins. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Preflight cache

Cut latency by caching OPTIONS responses. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

CDN config

Configure CORS once at the edge for every asset. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready
FAQ

Frequently asked questions

Wildcard works for public, anonymous APIs but Allow-Credentials forces a specific origin. Echo Origin per request for flexibility.
For non-simple requests browsers send an OPTIONS request first to fetch the CORS policy. Max-Age caches that result.
Header names compare case-insensitively, but listing them as the browser sends them keeps logs cleaner.
On the server response (Nginx, Apache, Express middleware, Cloudflare Worker, etc.) — the browser only reads them.
No — header strings are composed locally in your browser.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!