日本語English

CORS Studio

When the browser blocks a request with a CORS error, paste the request (Origin, method, headers, credentials) and the response headers. The tool says whether the browser allows it and why, header by header, and builds the server settings that allow it.

On-device・No uploadMobile friendlyWorks offline

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

Request (what the page sends)

Like https://app.example.com. Use null for a sandboxed iframe or file://.

GET, POST and so on.

For example application/json. Empty means the request sends none.

Authorization, X-Requested-With and so on. Accept, Accept-Language and Content-Language are safe and need not be listed.

Include the status line such as "HTTP/1.1 204" if you have it. The Network tab of developer tools shows it.

One "Name: value" per line. When a header appears twice, the browser joins the values with ", ".

Enter the request Origin, and paste response headers if you have them.

How to use

  1. In the Check tab, enter the page origin, the method, the request header names, the Content-Type value and whether credentials are sent.

  2. Paste the headers of the preflight (OPTIONS) response and of the actual response (GET or another real response). You can copy them from the Network tab of developer tools.

  3. Read the verdict and the ✓ and ✗ for each header with its fix. If you leave a response empty, the tool says the decision cannot be made yet.

  4. In the Make a setting tab, choose the allowed origins, methods and headers. The tool shows the response headers and examples for nginx, Apache, Express and Next.js.

What it does

Checks whether a preflight is needed

Follows the Fetch Standard: the method must be GET, HEAD or POST; the request headers must be safelisted (such as Accept); Content-Type must be application/x-www-form-urlencoded, multipart/form-data or text/plain.

Per-header CORS checks

Checks Access-Control-Allow-Origin against the request Origin (scheme, port and host name mismatches are explained separately), Allow-Credentials, Allow-Methods, Allow-Headers (the meaning of * and the Authorization exception), Expose-Headers and Vary: Origin, one row each.

Common mistakes explained

Shows the fix for * with credentials, a trailing slash in the origin, null origins, more than one Allow-Origin value, and Set-Cookie in Expose-Headers.

Settings for nginx, Apache, Express and Next.js

Builds settings that check the request Origin against your allowed list and return only a match. The preflight is answered with 204. The Express example does not use the cors package.

Use cases

  • A fetch call fails with “blocked by CORS policy” and you want to know which Access-Control header causes it
  • A JSON POST fails at the preflight and you need to know whether Content-Type or Authorization is the reason
  • A request with cookies fails because the server answers with *, and you want the reason
  • You need to allow several site origins in nginx or Express
  • You want to know whether Vary: Origin is needed for caching

Supported formats

Input

Request origin, method, request header names and the Content-Type valuePreflight (OPTIONS) response headers, status line optionalActual response headers, status line optional

Capability matrix

FeatureSupportNotes
Deciding whether a preflight is needed (Fetch Standard)Supported—
Per-header CORS checks with fixesSupported—
Settings for nginx, Apache, Express and Next.jsSupported—
Fetching the real response headers from a URLNot supportedNo network access. Paste the response headers instead
Reproducing the browser’s behaviour exactlyNot supportedThe verdict follows the specification. Small differences between browsers are not checked
Checking authentication or the API bodyNot supportedOnly the CORS response headers are read
Blocking requests from outside browsers (such as curl)Not supportedCORS is a mechanism that limits what browsers let a page read

Limits & notes

  • The verdict is based only on the headers you paste. Results in a real browser can differ because of caching, extensions or the browser version.
  • The upper limit for how long a preflight result may be reused (Access-Control-Max-Age) differs between browsers. This tool does not state a number for it.
  • The request origin must be http or https (or null). Access-Control-Allow-Origin is compared literally with the request origin, so a trailing slash or a different letter case does not match.
  • Input limits: 20,000 characters per box, and up to 200 lines of headers.
  • Example domains are placeholders. Where a setting goes depends on your proxy, CDN or framework.
  • Works on phones too, but PC is recommended for long pasted headers.

Privacy & safety

The headers, origins and settings you enter are processed only in your browser. Nothing is sent to or stored on a server.

FAQ

Why does a CORS error happen?
The browser gives a response from another site to the page’s JavaScript only when the response allows the page’s origin, through Access-Control-Allow-Origin and related headers. Otherwise it reports a CORS error, even when the server is running fine.
I sent * in Access-Control-Allow-Origin, but a request with credentials still fails. Why?
With credentials (such as cookies), * does not match. Return the origin itself and send Access-Control-Allow-Credentials: true.
What is a preflight (OPTIONS) request?
It is a check the browser sends before a request that uses an unsafe method (such as PUT or DELETE) or an unsafe header (such as Authorization) or an unsafe Content-Type (such as application/json). If the check is not allowed, the actual request is not sent.
How do I allow several site origins?
Access-Control-Allow-Origin can hold only one value. Check the request Origin against your list, return the match only, and send Vary: Origin. The Make a setting tab shows the code.
Why is Vary: Origin needed?
It tells caches (a CDN or the browser) that the response depends on the Origin. Without it, a response meant for one origin can be served to another.

CSP Studio

Paste a Content-Security-Policy header or meta tag to see unsafe-inline, unsafe-eval, wildcards and missing object-src or base-uri, ranked high, medium or low, with a suggested policy. Generation and hash calculation are included.

No upload

Cookie / Set-Cookie Studio

Paste a Cookie header or Set-Cookie lines to see each attribute (Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite, Partitioned) in a table, with points to check. The form also builds a Set-Cookie header and framework code.

No upload

curl Converter

Paste “Copy as cURL” from Chrome or Firefox to see the method, URL, headers, cookies and body in tables, then convert to 12 kinds of code. The request is never sent and everything runs in your browser. Authorization and cookies can be hidden before you share.

No upload

Cache-Control Studio

Paste a Cache-Control header to see how long the browser and a CDN keep the response, and whether it must be revalidated before use. It flags contradictions such as no-store with max-age, and builds the header for common uses.

No upload

HTML Inspector

Paste a page’s HTML to review SEO and accessibility basics at a glance: heading structure, meta tags, Open Graph, image alt text, links and structured data — with a preview of how it may look in search and on social media.

No upload

robots.txt Tester

Paste a robots.txt to see instantly whether a URL is allowed or blocked for Googlebot or AI crawlers, and which line decided it. Misspellings and directives Google ignores are flagged too.

No upload

Last updated: