CORS Checker
Simulate an HTTP request from a specific origin to test if an API allows Cross-Origin Resource Sharing.
CORS Checker
Simulate cross-origin requests to test if a server's CORS policies allow your application.
Enter a Target URL and an Origin to simulate a cross-origin HTTP request.
How this tool works
Because web browsers enforce the Same-Origin Policy, you cannot test CORS headers directly from a web page using JavaScript if the target server rejects the origin. This tool uses our backend server to simulate a CORS "preflight" request (an OPTIONS request) by injecting the Origin and Access-Control-Request-Method headers that you provide.
The tool then parses the response from the server and looks for the Access-Control-Allow-Origin header. If the header is missing, or if it does not match the requested Origin (or a wildcard *), the request is considered blocked by CORS.
Common CORS Errors
- No Access-Control-Allow-Origin header is present: The server isn't configured for CORS at all.
- Multiple origins provided: The server returned multiple origins in the header (e.g.,
site1.com, site2.com). This is strictly invalid according to the CORS specification. It must return exactly one origin or a wildcard. - Wildcard not allowed with credentials: The server returned
*but the request required credentials (like cookies or auth headers). In this case, the server must echo back the exact origin.
Related Guides
Deepen your understanding with our expert articles.