CORS Headers Generator (Access-Control-Allow-*)

Generate CORS headers (Access-Control-Allow-*) for your server.

▸Access-Control-Allow-Origin▸Methods

▸Allow-Headers

Max-Age

▸Generated headers

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400

🔒 100% client-side — no data sent

Build your CORS headers (Access-Control-Allow-Origin, Methods, Headers…) effortlessly and fix cross-origin policy errors. Copy a ready-to-use config for Nginx, Apache or your server code. Generated locally in the browser, no data sent.

What is it for?

▸ Fix a "blocked by CORS policy" error
▸ Allow specific origins and methods for your API
▸ Configure preflight (OPTIONS) requests and credentials
▸ Generate CORS config for Nginx, Apache or Express

FAQ

What are CORS headers for?

They tell the browser which external origins are allowed to access your resource, preventing cross-origin blocks.

Can I allow all origins with a wildcard?

Yes with *, but it's incompatible with sending credentials (cookies); specify an explicit origin then.

What is a preflight request?

An OPTIONS request the browser sends before certain requests to check the server allows the method and headers.

Related tools

Basic Auth · header generator Generate the HTTP Authorization: Basic header from a username and password. Bearer · Authorization header Generate the HTTP Authorization: Bearer header and extract a token from a header. Code playground (JS/TS/Python/PHP) Run JavaScript, TypeScript, Python or PHP and see the result instantly, 100% in your browser. Color shades Generate the tints and shades of a color for your palette, in your browser. Cookie · parser Break down a Cookie or Set-Cookie header into readable key/value pairs. Cron expression generator Build a cron expression from simple options (frequency, minute, hour), in your browser.