Skip to content
Webmaster Tools
Inspect & debugCORS Checker

CORS Checker

Preflight and allowed origins.

Sends an OPTIONS preflight (requesting Content-Type and Authorization) and a GET, both with this Origin.

About the CORS Checker

Cross-Origin Resource Sharing decides whether JavaScript on one origin can read responses from another. This tool acts like a browser on the origin you choose: it sends an OPTIONS preflight with Access-Control-Request-Method set to your method and Access-Control-Request-Headers: content-type, authorization, plus a plain GET with the same Origin header. It then gives a verdict, Allowed or Blocked, with a pass, warn or fail line per check.

The checks cover whether Access-Control-Allow-Origin is * or matches your origin exactly, whether the preflight returned a 2xx status, whether the method is safelisted (GET, HEAD, POST) or listed in Access-Control-Allow-Methods, whether Content-Type and Authorization are allowed, and whether credentials are allowed (including the invalid * plus credentials combination). It also warns when an origin-specific response lacks Vary: Origin, and shows the raw Access-Control-* headers of both responses. Redirects are not followed.

How to use it

  1. Enter the API URL your frontend calls.
  2. Enter the origin of the page making the request, such as https://app.example.com (defaults to https://example.com).
  3. Pick the method and select Check CORS.

Examples

Common questions

Why does my request work in curl but fail in the browser?

CORS is enforced by browsers, not servers. curl ignores it, while a browser refuses to expose the response to your script unless the server sends the right headers.

Can I use Access-Control-Allow-Origin: * with cookies?

No. Credentialed requests require the exact origin in Access-Control-Allow-Origin and Access-Control-Allow-Credentials: true.

Why is there a preflight request at all?

Browsers send one before methods like PUT or DELETE, or when a request sets headers such as Authorization or a JSON Content-Type, to confirm the server accepts them.