← BBobop
🌐 CORS Tester
CORS errors are the most common reason devs cry into their keyboards. Let's fix that.
Server Configuration
Access-Control-Allow-Origin
Access-Control-Allow-Methods
Access-Control-Allow-Headers
Access-Control-Allow-Credentials
false
true
Access-Control-Max-Age (seconds)
Access-Control-Expose-Headers
Request Simulation
Request Origin
Request Method
GET
POST
PUT
DELETE
PATCH
Request Headers (comma-separated)
Content-Type
application/json
text/plain
application/x-www-form-urlencoded
multipart/form-data
Includes Credentials
No
Yes
🧪 Simulate CORS Request
Preflight Analysis
Request Flow
Generated Headers
Common Fixes
Quick Scenarios
Public API (Any Origin)
Allow-Origin: * — open to all origins
Credentialed Request
Specific origin + cookies
Restrictive API
Single origin, limited methods
Common Mistake
Wildcard + credentials (will fail!)