Runs entirely in your browser — nothing leaves this page.

CORS generator

Build a correct CORS policy and get it as Nginx, Go (Chi/Gin), Express or Caddy config — or paste response headers and see what a browser concludes.

Allowed origins (one per line)any origin (*)

Methods

Allowed request headers

Exposed response headers

Allow credentials (cookies)

Max-Age (s)

Config

location /api/ {
    add_header Access-Control-Allow-Origin "https://app.example.com" always;
    add_header Vary "Origin" always;

    if ($request_method = OPTIONS) {
        add_header Access-Control-Allow-Origin "https://app.example.com" always;
        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        add_header Access-Control-Max-Age 86400 always;
        return 204;
    }

    # proxy_pass … ;
}

CORS that browsers actually accept

Describe the policy once — origins, methods, headers, credentials, preflight cache — and get it as a config for where your edge actually lives: an Nginx location with a map-based origin allowlist, Go middleware for Chi or Gin, the Express cors package, or a Caddyfile block. The generator refuses to produce the combinations browsers reject, like a wildcard origin with credentials.

The analyze mode works backwards: paste the response headers you actually got (from devtools or curl -i) and see what a browser will conclude from them, with the same warnings applied.

Why does my API work in curl but fail in the browser with a CORS error?

CORS is enforced by browsers only — curl never checks it. The browser sent a preflight OPTIONS request or checked the response's Access-Control-Allow-Origin and your server didn't answer correctly. The error is real configuration feedback, not a curl/browser inconsistency.

Why can't I use * with cookies?

Because that combination would let any site on the internet make authenticated requests as the visitor. The spec requires a specific origin when credentials are allowed — echo the request's origin only if it is on your allowlist, and add Vary: Origin so caches keep the variants apart.

Is CORS a security mechanism for my API?

It protects browser users, not your API — non-browser clients ignore it entirely. Authentication and authorization still do all the real work; CORS just controls which web pages may read responses through a visitor's browser.

What does Max-Age actually save?

It lets the browser cache the preflight verdict so repeated requests skip the extra OPTIONS round trip. 86400 (one day) is a common ceiling — browsers cap it anyway (Chrome at 2 hours), so bigger values buy nothing.

Related tools: HTTP headers, Security headers and CSP analyzer.