CORS Tester & Checker
Test any URL for CORS headers, diagnose cross-origin errors, and get framework-specific fix suggestions. Enter a URL to test or leave it blank for a comprehensive CORS explainer.
How the CORS Tester & Checker Works
This free online CORS tester sends a real fetch request from your browser to any URL you specify, then inspects the response for standard CORS headers. It checks whether the server allows your origin, which HTTP methods are permitted, whether credentials can be sent, and how long the browser should cache the preflight response. If the request fails due to CORS restrictions, the tool explains exactly what went wrong and gives you copy-paste code to fix it in your specific backend framework.
How CORS Works
When your JavaScript makes a request to a different domain than the page it runs on, the browser performs a security check called Cross-Origin Resource Sharing (CORS). For simple GET requests, the browser adds an Origin header and checks the response for Access-Control-Allow-Origin. For complex requests (PUT, DELETE, or requests with custom headers), the browser first sends an OPTIONS preflight request to verify the server allows it before sending the actual request.
Why You Need a CORS Tester
CORS errors are among the most common and frustrating issues in web development. The browser console shows a generic "blocked by CORS policy" message that does not tell you which specific header is missing or misconfigured. This tool gives you a complete breakdown of every CORS header the server returns (or does not return), pinpoints exactly what needs to change, and provides ready-to-use code snippets for popular backend frameworks including Express, Laravel, Django, Rails, NestJS, and Spring Boot.
Common CORS Issues and Fixes
The most frequent CORS error is a missing Access-Control-Allow-Origin header. Other common problems include the origin not matching exactly (including protocol and port), the requested HTTP method not being listed in Access-Control-Allow-Methods, custom headers not being listed in Access-Control-Allow-Headers, and credentials being required but Access-Control-Allow-Credentials not being set to true. Each of these has a specific fix on the server side.
Understanding Preflight Requests
A preflight request is an automatic OPTIONS request the browser sends before certain cross-origin requests. It occurs when you use HTTP methods other than GET, HEAD, or POST, when you set custom headers, or when you send certain content types. The preflight checks if the server allows the actual request. If the preflight fails, the browser never sends the real request. The Access-Control-Max-Age header controls how long the browser caches the preflight result, reducing overhead for repeated requests.
CORS Explainer Mode
If you leave the URL field empty and click the button, the tool displays a comprehensive visual guide to how CORS works. This includes the request-response flow, the role of each CORS header, when preflight requests are triggered, and a comparison of simple versus complex requests. This is useful for learning or for sharing with team members who are new to cross-origin concepts.
Privacy and Security
All CORS testing happens directly from your browser. The fetch request goes from your machine to the target URL — no proxy server is involved. Your URLs, headers, and results are never stored or transmitted to any third party. This makes the tool safe for testing internal APIs, staging environments, and endpoints that require authentication.
Frequently Asked Questions
What is CORS and why does it exist?
CORS (Cross-Origin Resource Sharing) is a browser security mechanism that restricts web pages from making requests to a different domain than the one that served the page. It exists to prevent malicious websites from reading sensitive data from other sites using your browser credentials. Servers must explicitly opt in by sending CORS headers.
Why do I get CORS errors in the browser but not in Postman or cURL?
CORS is enforced only by web browsers. Tools like Postman, cURL, and server-side HTTP clients do not implement CORS restrictions because they are not running untrusted JavaScript in a browser context. If your API works in Postman but not in the browser, the server is missing the required CORS headers.
What is a preflight request?
A preflight request is an automatic OPTIONS request the browser sends before certain cross-origin requests. It checks if the server allows the actual request method, headers, and origin. Preflight is triggered by non-simple methods (PUT, DELETE, PATCH), custom headers, or certain content types. The server must respond with appropriate Access-Control-Allow-* headers.
Can I use a wildcard (*) for Access-Control-Allow-Origin?
Yes, you can set Access-Control-Allow-Origin to * to allow any origin. However, if your request includes credentials (cookies, authorization headers), the wildcard is not allowed — you must specify the exact origin. Additionally, using a wildcard means any website can read the response, which may be a security concern for sensitive APIs.
How do I fix CORS errors on my server?
The fix depends on your backend framework. Generally, you need to add middleware or configuration that sets the Access-Control-Allow-Origin header to your frontend domain (or *), along with Access-Control-Allow-Methods and Access-Control-Allow-Headers for the methods and headers your frontend uses. This tool provides copy-paste code snippets for Express, Laravel, Django, Rails, NestJS, and Spring Boot.