CORS Header Generator

Build a CORS configuration for an API with explicit control over origins, methods, headers, credentials, and preflight caching. Copy plain response headers or implementation examples for Express, Nginx, and Apache.

Features

Visual CORS configurationCommon presetsMultiple origin supportPreflight handlingServer config examplesCopy configurations

CORS Header Generator

Quick Presets

Allowed Origins

Allow all origins (*)

https://example.com

Allowed Methods

Allowed Headers

Common headers:

Content-Type

Authorization

Additional Settings

Allow credentials (cookies, auth headers)

Max Age (seconds)

How long the browser can cache preflight response (0-86400)

Exposed Headers

Generated Configuration

About CORS

Cross-Origin Resource Sharing (CORS) is a security feature implemented by web browsers to prevent malicious websites from accessing resources on other domains without permission.

Important Notes:

CORS headers must be set by the server, not the client
Preflight requests (OPTIONS) are sent for non-simple requests
You cannot use wildcard (*) origin with credentials
Multiple origins require dynamic origin checking on the server
Some browsers cache preflight responses based on Max-Age

Common Issues:

Missing OPTIONS handler for preflight requests
Not including credentials when needed
Forgetting to expose custom response headers
Setting multiple origins in a single header (invalid)

How to use the CORS Header Generator

1Start from a preset or add the exact origins allowed to call your API.
2Select permitted methods and request headers.
3Configure credentials, exposed headers, and preflight cache duration when needed.
4Choose the target server format, copy the configuration, and test it with a real browser request.

Common uses

Allow a frontend application to call an API on another origin.
Configure authenticated requests that include cookies or authorization headers.
Create Express, Nginx, Apache, or raw header examples for deployment.

CORS is configured on the server

The browser enforces CORS, but the API server must return the response headers. Adding CORS headers to frontend requests does not grant access.

Origins and credentials

Credentialed requests cannot use a wildcard Access-Control-Allow-Origin value. Validate the incoming Origin against an allowlist and return one matching origin.

Frequently asked questions

Can I fix CORS from frontend JavaScript?

No. The requested server or an authorized proxy must return the correct CORS response headers.

Can I use an asterisk with cookies?

No. Credentialed requests require a specific allowed origin rather than the wildcard value.

Why does the browser send an OPTIONS request?

That is a preflight request used to check whether the server permits the intended method and headers.

CORS Header Generator

Features