CORS Tester
Run OPTIONS and GET requests with an Origin and custom headers to evaluate CORS responses.
How to Test CORS?
- Enter the API endpoint URL you want to test.
- Specify the Origin header (your website's URL).
- Select HTTP method (OPTIONS for preflight, GET for actual request).
- Optionally add custom request headers (one per line: Name: Value).
- Click Run Test to see CORS headers and allowed origins.
Free CORS Headers Tester
Test Cross-Origin Resource Sharing (CORS) configuration for any API endpoint. CORS is a browser security mechanism that controls which origins can make requests to your API. Misconfigured CORS causes cryptic errors in web apps — this tool helps you diagnose them without writing code.
What This Tool Checks
- Preflight Requests — Sends an OPTIONS request to check if the browser's preflight will succeed
- Allowed Origins — Verifies that Access-Control-Allow-Origin includes your domain
- Allowed Methods & Headers — Confirms the HTTP methods and headers your app needs are permitted
- Credentials Support — Checks Access-Control-Allow-Credentials for cookie-based auth
Ideal for debugging CORS errors during API integration, validating third-party API configurations, and testing before deployment.
Frequently Asked Questions
What is CORS and why does it matter?
CORS (Cross-Origin Resource Sharing) is a browser security policy that blocks web pages from making requests to a different domain unless the server explicitly allows it. It matters because without it, any website could silently make requests on behalf of your users.
What is the difference between a preflight and a simple CORS request?
Simple requests (GET, POST with standard headers) are sent directly. Preflight requests are OPTIONS requests the browser sends first to ask permission before making the actual request. Preflight is triggered by custom headers, PUT/DELETE methods, or non-standard content types.
Why do I get a CORS error even when the server has CORS headers?
Common reasons: the origin doesn't exactly match (including protocol and port), credentials are sent but Access-Control-Allow-Credentials is not set, or the allowed headers list doesn't include your custom header. Use this tester to see the exact headers returned.
Does this tool test from the server side or browser side?
This tool makes the request from the server side, so it bypasses browser CORS restrictions. It shows the raw headers returned by the target server, letting you diagnose server configuration independently of browser behavior.
