Try it

Request origin

An origin such as https://app.example.com. Leave empty to see the wildcard behaviour.

Method

Include credentials (cookies/authorization)

Suggested response headers: Access-Control-Allow-Origin: https://app.example.com Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Credentials: false Access-Control-Max-Age: 600
Header reference: Origin (request) — The scheme, host and port the request was issued from. Access-Control-Request-Method (preflight) — The method the actual request will use. Access-Control-Request-Headers (preflight) — The non-simple header names the actual request will send. Access-Control-Allow-Origin (response) — The origin allowed to read the response, or * for credential-less requests. Access-Control-Allow-Methods (response) — The methods permitted on the resource for cross-origin requests. Access-Control-Allow-Headers (response) — The header names permitted in the actual request. Access-Control-Allow-Credentials (response) — Whether the request may include credentials such as cookies. Access-Control-Expose-Headers (response) — The response header names readable by the page's script. Access-Control-Max-Age (response) — How long a preflight result may be cached, in seconds.
Notes: With * the response is readable by any origin but credentials are not allowed; echo the origin when you need credentials. A preflight is required when the method is not GET/HEAD/POST or a header is not a CORS-safelisted request header. This is a reference that builds response-header guidance only; it never sends a request or checks a live server.

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: false
Access-Control-Max-Age: 600

Supported formats

Input: text, select, boolean
Output: text, json

Privacy

Runs entirely in your browser. Your input is never uploaded, stored, or sent to a third party.

Processing: In your browser
Privacy level: Browser only

Built 5 guidance response header(s) for a credentialed POST from https://app.example.com.

How it works

Listed the CORS request, preflight and response headers with their meaning.
Chose to echo the exact origin because credentialed requests cannot use the wildcard.
Included the method, headers, credentials and max-age guidance.

This is a reference and a header builder only; it never sends a request or checks a live server.
A server must actually send these headers for the browser to expose the response.

Methodology

List the CORS request, preflight and response headers with their direction and meaning.
For the supplied origin and credentials mode, choose between echoing the origin and the wildcard per the Fetch rule.
Build guidance Access-Control-Allow-Origin, -Methods, -Headers, -Credentials and -Max-Age values.
State the preflight and credentials constraints that apply to the chosen mode.

Usage

Enter the request origin (or leave it empty to see the wildcard behaviour).
Choose the request method and whether credentials are included.
Read the header reference and the generated response-header guidance.

Examples

These are examples, not current values: they use fixed inputs, while the interactive tool computes live results in your browser.

Credentialed request from an app origin

{
  "origin": "https://app.example.com",
  "method": "POST",
  "credentials": true
}

Example result

{ "entries": [ { "header": "Origin", "direction": "request", "meaning": "The scheme, host and port the request was issued from." }, { "header": "Access-Control-Request-Method", "direction": "preflight", "meaning": "The method the actual request will use." }, { "header": "Access-Control-Request-Headers", "direction": "preflight", "meaning": "The non-simple header names the actual request will send." }, { "header": "Access-Control-Allow-Origin", "direction": "response", "meaning": "The origin allowed to read the response, or * for credential-less requests." }, { "header": "Access-Control-Allow-Methods", "direction": "response", "meaning": "The methods permitted on the resource for cross-origin requests." }, { "header": "Access-Control-Allow-Headers", "direction": "response", "meaning": "The header names permitted in the actual request." }, { "header": "Access-Control-Allow-Credentials", "direction": "response", "meaning": "Whether the request may include credentials such as cookies." }, { "header": "Access-Control-Expose-Headers", "direction": "response", "meaning": "The response header names readable by the page's script." }, { "header": "Access-Control-Max-Age", "direction": "response", "meaning": "How long a preflight result may be cached, in seconds." } ], "guidance": [ "Access-Control-Allow-Origin: https://app.example.com", "Access-Control-Allow-Methods: POST, OPTIONS", "Access-Control-Allow-Headers: Content-Type, Authorization", "Access-Control-Allow-Credentials: true", "Access-Control-Max-Age: 600" ], "notes": [ "When credentials are included, Access-Control-Allow-Origin must echo the exact origin; the wildcard * is not allowed.", "A preflight is required when the method is not GET/HEAD/POST or a header is not a CORS-safelisted request header.", "This is a reference that builds response-header guidance only; it never sends a request or checks a live server." ] }

Credential-less public API

{
  "origin": "https://app.example.com",
  "method": "GET",
  "credentials": false
}

Example result

{ "entries": [ { "header": "Origin", "direction": "request", "meaning": "The scheme, host and port the request was issued from." }, { "header": "Access-Control-Request-Method", "direction": "preflight", "meaning": "The method the actual request will use." }, { "header": "Access-Control-Request-Headers", "direction": "preflight", "meaning": "The non-simple header names the actual request will send." }, { "header": "Access-Control-Allow-Origin", "direction": "response", "meaning": "The origin allowed to read the response, or * for credential-less requests." }, { "header": "Access-Control-Allow-Methods", "direction": "response", "meaning": "The methods permitted on the resource for cross-origin requests." }, { "header": "Access-Control-Allow-Headers", "direction": "response", "meaning": "The header names permitted in the actual request." }, { "header": "Access-Control-Allow-Credentials", "direction": "response", "meaning": "Whether the request may include credentials such as cookies." }, { "header": "Access-Control-Expose-Headers", "direction": "response", "meaning": "The response header names readable by the page's script." }, { "header": "Access-Control-Max-Age", "direction": "response", "meaning": "How long a preflight result may be cached, in seconds." } ], "guidance": [ "Access-Control-Allow-Origin: https://app.example.com", "Access-Control-Allow-Methods: GET, OPTIONS", "Access-Control-Allow-Headers: Content-Type, Authorization", "Access-Control-Allow-Credentials: false", "Access-Control-Max-Age: 600" ], "notes": [ "With * the response is readable by any origin but credentials are not allowed; echo the origin when you need credentials.", "A preflight is required when the method is not GET/HEAD/POST or a header is not a CORS-safelisted request header.", "This is a reference that builds response-header guidance only; it never sends a request or checks a live server." ] }

Limitations

The same-origin policy and CORS

Browsers block a page from reading a cross-origin response by default. CORS is the server's opt-in: it names the origins, methods and headers a browser may expose. The server controls this entirely; a page cannot grant itself access. That is why the fix for a CORS error is a server response header, never a client setting.

Simple requests and preflight

A simple request is sent directly and the response is blocked afterwards if CORS is missing. Anything else triggers a preflight OPTIONS request first, and the browser only sends the real request when the preflight allows it. This distinction explains why an error sometimes appears before any request method reaches your logs.

Frequently asked questions

Why can't I use Access-Control-Allow-Origin: * with credentials?: The Fetch standard forbids it: with credentials, the server must echo the exact origin so one response cannot be reused across origins. The generator reflects that by emitting the origin when credentials are enabled.
When does the browser send a preflight?: When the request is not a CORS simple request: a method other than GET, HEAD or POST, or a header that is not CORS-safelisted. The browser then sends an OPTIONS request first and needs the allow headers before the real request.
Does a blocked CORS response mean the request failed?: Not necessarily. CORS is enforced by the browser, so the server may have received and processed the request even though the page cannot read the response.

Sources

WHATWG Fetch Standard — CORS protocol — WHATWG
MDN Web Docs — Cross-Origin Resource Sharing (CORS) — MDN

Send feedback

Tell us if this tool helped, report a problem, or suggest a tool. Only the message you type is sent — never the input you used in the tool.

Was this tool useful?

Prefer to write to us directly? See the contact page.