CORS Header Generator

About CORS Generator

Writes cross-origin resource sharing configuration for the server that has to send it — raw headers, nginx, Apache, Caddy, IIS, Express, Fastify, Next.js, Go, Flask, FastAPI, Django, ASP.NET Core, Spring Boot, Laravel, Rails or an S3 bucket — and tests an origin against it to show exactly which headers that site would receive.

Several origins cannot share one header. Access-Control-Allow-Origin holds a single origin or *, so allowing a list means checking each request's Origin and echoing it back, with Vary: Origin so caches keep them apart. Every target here does that in its own idiom, and wildcard subdomains such as https://*.example.com become the pattern match each library supports.

The rules browsers enforce are checked. A wildcard origin with credentials is rejected by every browser; the null origin is an attacker's origin; plain http origins can be forged on the network; and a preflight capped by Chrome at two hours. Each is reported where it applies.

Origins are cleaned on the way in: a trailing slash or a path makes an origin never match, and a missing scheme is not an origin at all.

Where it helps

• Seventeen targets, each echoing an allowed origin the way that server or framework does it.
• Adds Vary: Origin whenever the origin is echoed, which is the line most hand-written configs forget.
• Turns wildcard subdomains into the pattern each library accepts.
• Handles preflight OPTIONS requests in the server configs, where they are most often broken.
• Tests a specific origin and shows the exact response headers it would get.
• Reports the combinations browsers reject before they reach production.

Limits

• CORS only controls which sites may read responses in a browser. It is not authentication and does not stop direct calls to the API.
• The configuration sets headers; it cannot fix a proxy, CDN or auth layer in front that swallows OPTIONS requests.
• S3 supports only GET, PUT, POST, DELETE and HEAD, so other methods are dropped for that target.
• Framework configs follow each library's current major version; older versions name some options differently.

Frequently asked questions

Why can't I list several origins in Access-Control-Allow-Origin?

The header takes exactly one origin or *. To allow several, the server compares the request's Origin header with its list and, if it matches, echoes that one origin back — and sends Vary: Origin so a cache does not give one site's response to another.

Why does the browser reject * with credentials?

Allowing any site to make requests carrying the visitor's cookies and read the answer would let every website on the internet act as that visitor. Browsers refuse the combination outright, so a credentialed API has to name its origins.

What is a preflight and why is my request failing it?

Before a request with a non-simple method or custom headers, the browser sends OPTIONS asking whether it is allowed. If that OPTIONS request hits a 404, a redirect or an authentication check, the real request is never sent. The server configs here answer OPTIONS directly with 204.

Does CORS protect my API?

No. It stops other websites' scripts from reading responses in a visitor's browser, which protects your users. Anyone can still call the API with curl or a server; authentication and authorisation have to be checked on every request.

Related tools

• CSP Generator — Build a Content-Security-Policy, or check one, and write it for your server or framework
• cURL Builder — Build an HTTP request and get it as curl, JavaScript, TypeScript, Go, Python, PHP, C#, Java and more
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Query String Parser and Builder — Convert query strings into editable key-value data
• HTML Formatter — Indent and tidy HTML markup
• CSS Formatter — Format stylesheets with consistent indentation

More Web Development tools

• HTML Formatter — Indent and tidy HTML markup
• CSS Formatter — Format stylesheets with consistent indentation
• JavaScript Formatter — Re-indent JavaScript and TypeScript source
• SCSS/SASS Formatter — Format SCSS syntax and nested rules
• TypeScript Formatter — Format TypeScript source code
• SQL Formatter — Format SQL statements with dialect selection
• SQL Minifier — Collapse formatted SQL into compact text
• CSS Unit Converter — px, rem, em, percentages and viewport units, with a preview
• Query String Parser and Builder — Convert query strings into editable key-value data
• CSP Generator — Build a Content-Security-Policy, or check one, and write it for your server or framework
• cURL Builder — Build an HTTP request and get it as curl, JavaScript, TypeScript, Go, Python, PHP, C#, Java and more
• Minifier — Shrink CSS, HTML or JavaScript
• Flexbox Playground — Try every flex property and read the CSS back
• CSS Grid Playground — Build a grid template and see the tracks it makes
• Responsive Viewport Tester — Render your markup at phone, tablet and desktop widths
• SVG Path Viewer — Draw path data and read back what it contains
• SVG to CSS Converter — Turn an SVG into a data URI for CSS or an img tag
• OAuth 2.0 / OIDC Helper — PKCE verifiers and challenges, state, nonce, and checking what came back
• Regex Tester — Test patterns, inspect groups and preview replacements
• User-Agent Parser — Identify the browser, engine, operating system and device behind a User-Agent string
• HTTP Status Codes — Look up what a status code means, when to send it, and whether it is cached or safe to retry
• HTML to JSX — Convert HTML and SVG markup into JSX for React, with styles, attributes and whitespace handled
• Semver Checker — Test versions against npm ranges, sort them by precedence, and see what each bump produces
• Cookie Parser and Builder — Read Set-Cookie and Cookie headers, check them against browser rules, and write one for your framework