CORS Header Generator

Generate Cross-Origin Resource Sharing (CORS) configurations instantly.

CORS Settings

Access-Control-Allow-Origin

Which domains can access your resources? Use * for all, or specify exactly (e.g., https://example.com).

Access-Control-Allow-Methods

Which HTTP methods are permitted?

Access-Control-Allow-Headers

Which headers can be used during the actual request?

Access-Control-Max-Age

How long (in seconds) the results of a preflight request can be cached.

Allow CredentialsAllow cookies, authorization headers or TLS client certificates. Cannot use '*' origin if enabled.

Expose HeadersWhich headers can the browser access in the response?

.htaccess

<IfModule mod_headers.c>
  Header set Access-Control-Allow-Origin "*"
  Header set Access-Control-Allow-Methods "GET, POST, OPTIONS"
  Header set Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization"
  Header set Access-Control-Max-Age "86400"
</IfModule>

What is CORS?

Cross-Origin Resource Sharing (CORS) is a security mechanism that allows a web page from one domain (origin) to access resources from a different domain. By default, web browsers block these requests for security reasons (the Same-Origin Policy). To allow them, the server must respond with specific Access-Control-Allow-* HTTP headers.

Understanding Preflight Requests

When a web browser sends a complex request (like a PUT, DELETE, or one with custom headers like Authorization), it first sends an OPTIONS request (called a "preflight" request) to ask the server if the actual request is permitted. The server responds to this preflight request with the CORS headers, letting the browser know it's safe to send the real request.

CORS and Credentials

If your request needs to send cookies, authorization headers, or TLS client certificates, you must enable Access-Control-Allow-Credentials: true. However, for security reasons, you cannot use the wildcard * for the Access-Control-Allow-Origin header when credentials are allowed. You must specify the exact origin.

Related Guides

Deepen your understanding with our expert articles.

The Complete Guide to HTTP Security HeadersRead guide →