CORS Configuration Explainer
Paste headers and set an origin and method to explain likely allow or deny outcomes, without sending requests.
Paste the Access-Control-* lines from the browser network tab or curl -i.
Try:
Scheme, host, and port only, such as https://app.example.com.
Separate with commas, such as Authorization, X-Api-Key.
Your result
Paste response headers to see whether a browser would allow the request.
How to use it
- Paste the headers.
- Type the origin and the method.
- Read the note, including that no request was sent.
Examples
- A matching GETAllow-Origin https://smart.example and Allow-Methods GET, for that origin and GET origin: listed method: listed credentials: false note: a browser script could read this response request: not sent
- A wildcard with credentialsa star origin and Allow-Credentials true origin: listed method: listed credentials: true note: a wildcard with credentials is rejected by browsers request: not sent
- A missing methodmethods GET, asked as POST origin: listed method: not listed credentials: false note: a browser script could not read this response request: not sent
Tool details and privacy
Paste response headers, an origin, and a method. The page says whether that origin and method are listed, and that no request was sent.
Pasted headers can be explained. Sending a request would be a different tool.
Options
- The origin comparison ignores letter case.
- Methods are compared in uppercase.
Limits
- No request is sent.
- A wildcard origin with credentials is rejected by browsers.
- Headers you do not paste are treated as absent.
Privacy
What you type stays in your browser. Nothing is uploaded or saved on the server.
Questions
Is a request sent?
No.
Can a browser use a star origin with credentials?
No. Browsers reject that combination.
What does a matching origin and GET report?
Both listed, and a browser script could read the response. The request was not sent.
Are the headers uploaded?
No.