CORS Debugger

Test cross-origin resource sharing headers for any URL.

Enter a URL above to inspect its CORS headers.

How it works

Requests are made server-side so the browser's own CORS enforcement doesn't interfere — you see the raw response headers exactly as the server sends them.

Simple requests (GET/HEAD/POST with safe headers) only need a matching Access-Control-Allow-Origin. Complex requests trigger a preflight OPTIONS check first.

The preflight must approve the method and any custom headers before the browser will send the real request.

Credentials (cookies, auth headers) require Access-Control-Allow-Credentials: true and a specific — not wildcard — origin.

Tips

Set the Origin to match your actual frontend domain — CORS validation is per-origin.

Add a custom header like Authorization to force a preflight and test whether your API handles it correctly.

If you see a 200 on the preflight but FAIL on origin, the Allow-Origin header may be missing or mismatched — check your server's CORS middleware config.

The Vary: Origin header should be present when Allow-Origin varies by request, to prevent CDN caching issues.