Web

CORS Tester

Cross-Origin Test

Run a CORS Test

Enter the target URL and the origin you'd be calling it from, then run the test to see whether the server's CORS policy would allow the request.
Target URL
Method
Request origin
Custom request headerscomma separated

Tool features

Comprehensive CORS analysis with actionable recommendations
4 checks

CORS Header Analysis

Comprehensive CORS header validation and origin access verification

Preflight Inspection

See the automatic OPTIONS preflight for non-simple requests and custom headers

Origin Validation

Verify if your origin is properly allowed by the target server

Security Assessment

Check CORS configuration for security best practices

What is CORS & how it works

The browser rule that governs cross-origin requests

Cross-Origin Resource Sharing (CORS) is a browser security mechanism that controls whether a web page on one origin (scheme + host + port) is allowed to read responses from a different origin. By default the browser blocks cross-origin reads; the target server opts specific origins back in by returning Access-Control-* response headers.

When a request isn't "simple" — a non-GET method, or custom headers like Authorization — the browser first sends an automatic OPTIONS preflight to ask the server what it permits. Only if the preflight passes does the real request go through.

Access-Control-Allow-Origin
Which origin(s) may read the response. An exact origin or *.
Access-Control-Allow-Methods
HTTP methods the endpoint accepts cross-origin, returned on preflight.
Access-Control-Allow-Credentials
Whether cookies and auth headers may be sent. Can't be paired with *.

How to use this tool

Run a cross-origin check in four steps
1
Enter the target URL
Paste the full endpoint you want to call, e.g. https://api.example.com/v1/data, and pick the HTTP method.
2
Set the request origin
Enter the origin your front-end runs on — this is the value the browser compares against the server’s Allow-Origin header.
3
Add custom headers & credentials
List any custom request headers (comma-separated) and toggle Credentials on if the call sends cookies or auth tokens.
4
Run the test & read the verdict
Hit Run Test to see the verdict, response headers and a per-check diagnostic of why the request is allowed or blocked.

Related tools

Keep debugging with tools from the same suite
4 tools
CORS Headers Checker
Check and analyze Cross-Origin Resource Sharing (CORS) headers for security configuration
HTTP Header Checker
Analyze HTTP response headers for any website or URL with detailed header information
Secure Header Checker
Check security headers like CSP, HSTS, X-Frame-Options, and more with security scoring
HTTP Status Checker
Check HTTP status codes and response details for any URL with detailed analysis

Frequently asked questions

Common questions about CORS and this tool
4 Q&A

Before a "non-simple" cross-origin request, the browser automatically sends an OPTIONS request to ask the server which methods, headers and origins it allows. The real request only proceeds if the preflight passes.

The spec forbids pairing Access-Control-Allow-Origin: * with Allow-Credentials: true. When cookies or auth headers are sent, the server must echo the exact requesting origin instead of a wildcard.

It performs a standard cross-origin request and reports the response headers exactly as a browser would see them. No data is stored.

The server responded fine, but the browser blocks JavaScript from reading the response because the CORS headers don't permit your origin. The request “succeeds” on the network yet the result is never exposed to your code.