CORS Tester

Postman and curl are not browsers, so they ignore the same-origin policy entirely — they send the request and read the response no matter what headers come back. A browser is stricter: when JavaScript on one origin calls a different scheme, domain, or port, it only lets your code read the response if the server returns the right Access-Control-Allow-Origin header. If that header is missing, the request still reaches the server and returns data, but the browser hides the response from your script and logs the CORS error. That is why an endpoint can look healthy in Postman yet fail in the console. This tool inspects the actual CORS headers a server sends back, so you can confirm the problem is server-side configuration rather than your fetch code. Paste your endpoint to see exactly which headers are present.

A preflight is an automatic OPTIONS request the browser sends before the real request, asking the server whether the actual call is allowed. It happens for "non-simple" requests: methods like PUT, DELETE, or PATCH, custom request headers, or content types such as application/json. The browser includes Access-Control-Request-Method and Access-Control-Request-Headers, and the server must answer with matching Access-Control-Allow-Methods and Access-Control-Allow-Headers values, or the real request never fires. Simple GET and POST requests with standard headers skip this step. Because preflights are invisible in most fetch code, a failing OPTIONS handshake is a common and confusing cause of CORS errors. This tester lets you send the request as OPTIONS and inspect the allowed methods and headers the server reports, so you can verify the preflight contract directly instead of guessing from a blocked console message.

The CORS specification forbids combining credentialed requests with a wildcard origin, and every browser enforces this. When you send cookies or authorization headers cross-origin, the server must echo back a specific origin in Access-Control-Allow-Origin — never the catch-all asterisk. If a server responds with both Access-Control-Allow-Credentials: true and Access-Control-Allow-Origin set to a wildcard, the browser rejects the response outright and your request fails, even though the headers look permissive. The fix is to reflect the exact requesting origin instead of using a wildcard, then keep the credentials header set to true. This tool flags that exact dangerous combination as an error in its CORS analysis, so you can catch it before it breaks an authenticated front-end. Run your credentialed endpoint through it to confirm the origin is specific rather than wildcarded.

A wildcard origin lets any website on the internet make cross-origin requests to your API and read the response, which is perfectly fine for genuinely public data like open datasets, public read-only APIs, or static JSON. It becomes risky the moment the endpoint returns anything sensitive or is reachable with a user's cookies, because a malicious site could then call it on a visitor's behalf. As a rule, restrict Access-Control-Allow-Origin to the specific domains that legitimately need access rather than opening it to everyone, and never pair a wildcard with credentials. This tester labels a wildcard origin as a warning and a specific domain as good, so you can see at a glance how exposed an endpoint is. Test your URL here to check whether its origin policy matches the sensitivity of the data it serves.

Access-Control-Max-Age tells the browser how many seconds it may cache the result of a preflight OPTIONS request. While that cache is valid, the browser skips the extra round trip and sends the real request straight away, which noticeably speeds up apps that fire many non-simple requests to the same endpoint. Without it, the browser may re-preflight on every call, adding latency. Values are capped by the browser — Chrome limits the cache to a couple of hours regardless of a higher number — so setting an enormous value will not help beyond that ceiling. A missing Max-Age simply means no preflight caching at all. This tool reads the header and translates the raw seconds into minutes in its analysis, so you can quickly judge how aggressively preflights are cached. Test your endpoint to see whether it sets a useful Max-Age.