Why doesn't curl reproduce CORS behaviour?

CORS is a browser-side security policy. curl ignores it entirely. A request that works in curl can still fail in the browser if the server doesn't return Access-Control-Allow-Origin matching the page origin.

What's a 'simple' vs 'preflighted' request?

Simple = GET/HEAD/POST with only 'safe' headers (Content-Type: text/plain or application/x-www-form-urlencoded, etc.). Anything else triggers a preflight OPTIONS request. The tool shows you which path your request takes.

Why does my preflight return 200 but the actual request fail?

Preflight only checks Access-Control-Allow-Origin and Access-Control-Allow-Methods. The actual request needs ACAO too. A server can pass preflight and still fail the real request if it doesn't set ACAO on every response.

cors · preflight · access-control-* · live

Test CORS from your browser

Q: Is anything sent to a server?

The preflight request goes to the URL you specify (it has to — that's the test). No third-party logging.

Send a real request from the current origin and inspect the Access-Control-* headers the server returned. Runs entirely in your browser.

CORS Tester

Status

—

live

Method

GET

verb

Origin

—

this page

CORS headers

access-control-*

input · custom headers

output · response

No response yet — hit Send.

Quick Start

How to test CORS

The browser blocks cross-origin reads unless the server opts in with Access-Control-* headers.

01
Pick a method and URL
The request goes from this origin to the endpoint.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
inputIANAregistryofflinelive
method · queryGET · IANA
```
GET https://api.github.com/...
```
loaded · IANA bundlespec · ready
02
Add custom headers
Any header that isn't in the safelist triggers a preflight (OPTIONS) request.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
preflightRFC 9110canonicalspec-compliantlive
headers · options1 · live
```
Authorization: Bearer …
```
options applied · livecanonical
03
Send the request
The browser performs the preflight if needed, then the actual request.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
fetchvalidationlintpitfallslive
status · looked up200 · ready
```
200 OK · CORS allowed
```
result · livevalidated
04
Inspect Access-Control-*
If they are missing, the browser blocks JS from reading the body even though the server replied.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
debugclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
Allow-Origin: *
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to test CORS

API integration, browser-to-API debugging.

Public API audit

Confirm the API returns the right Allow-Origin. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Preflight diagnosis

See which header triggered the OPTIONS round-trip. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Credentialed flows

Verify Allow-Credentials matches your fetch options. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Custom headers

Spot missing Access-Control-Allow-Headers. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Cache control

Tune Access-Control-Max-Age to reduce preflights. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

SPA migration

Confirm your new domain is whitelisted. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

Why does the response say 'blocked' but I see headers in DevTools?

The server replied, but the browser hides the body from JS when CORS headers don't allow the origin. The status code is still readable here.

Can I send custom headers without a preflight?

Only a small safelist (Accept, Content-Language, etc.). Anything else triggers an OPTIONS preflight.

What about cookies?

Add credentials: include in your real fetch call and require Access-Control-Allow-Credentials: true on the server. * for Allow-Origin is then forbidden.

Why does this fail with no error?

Some browsers eat the CORS error and surface a generic network failure. Check the Network panel for the actual reason.

Is anything sent to a server?

Yes — your test request goes to the URL you enter. Everything else runs locally in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!