CORS Tester
Enter a URL to see the CORS headers it returns and whether it would allow a cross-origin request.
Overview
CORS (Cross-Origin Resource Sharing) headers tell browsers whether a page running on one origin is allowed to read a response from another origin. This tool sends a request to a URL with a synthetic Origin header and reports back the Access-Control-Allow-* headers the server returns, the same signals a browser's own CORS logic inspects before allowing a cross-origin fetch to succeed.
This checks the actual response headers a server sends — it doesn't run inside a browser, so it can't reproduce browser-specific edge cases like preflight caching, but it's a fast way to confirm the basic CORS configuration before wiring up a real cross-origin request.
Examples
An API allowing all origins
https://api.example.com/data
access-control-allow-origin: *
How It Works
- Enter a full URL, including https:// or http://.
- Complete the verification check if shown.
- Click Test to send a request with a synthetic Origin header.
- Review the CORS headers returned and whether the origin is allowed.
Use Cases
Debugging a blocked cross-origin API call
Check whether an API actually sends the CORS headers a frontend needs before assuming the client code is at fault.
Auditing an API's CORS policy
Confirm whether an endpoint allows all origins (*) or a specific allowlist, and whether it allows credentials.
Tips
- access-control-allow-origin: * combined with allowing credentials is invalid per the CORS spec — browsers reject that combination outright.
- A missing Access-Control-Allow-Origin header means the browser will block the response from being read cross-origin, even if the request itself succeeds at the network level.
FAQ
It sends a request with an Origin header and reports the CORS headers returned, which covers the core signals, but it doesn't reproduce every browser-specific preflight caching or credentialed-request nuance.
This tool makes an outbound request to a URL you choose, so a quick bot check helps prevent the tool being used to flood arbitrary sites with automated traffic.