Generator Settings
Scenario
Public API — anyone may call it
Known origins — your own front ends
Credentialed — cookies or auth headers
Static assets — fonts, images
Allowed origins
https://app.example.com https://admin.example.com
One per line, scheme and host, no trailing slash. Wildcard subdomains are
not
valid CORS — the server must match and echo the origin.
Methods
Allowed request headers
Comma-separated.
Authorization
is never covered by a wildcard — it must always be named.
Exposed response headers
Headers your JavaScript may read. Without this, only a handful of safe-listed headers are visible to
fetch
.
Options
Allow credentials
Cookies and
Authorization
on cross-origin requests.
Send
Vary: Origin
Required whenever the origin is echoed. Prevents cache poisoning.
Include preflight handling
Answers
OPTIONS
with 204 before auth runs.
Preflight cache (Access-Control-Max-Age)
0 — do not cache
600 — 10 minutes
7200 — 2 hours (Chrome's cap)
86400 — 24 hours (Firefox's cap)
Generate
Reset
Generated Headers
ready
Headers
Request simulator
Server config
Checks
Reference
Response headers
Copy
Download
CORS is enforced by the
browser
, on behalf of the user. It is not server-side access control — curl, a mobile app or any server-side client ignores these headers entirely. Never use CORS as authorisation.
Requesting origin
Method
GET
POST
PUT
PATCH
DELETE
Content-Type
(none)
application/json
application/x-www-form-urlencoded
multipart/form-data
text/plain
Custom headers
Platform
Nginx
Apache / .htaccess
Express
Vercel — vercel.json
Cloudflare Worker
nginx.conf
Copy config