CORS Setup Auditor & Tester

What is the CORS Header Tester?

This tool sends a real HTTP request to an API endpoint with a chosen Origin header and shows you exactly which Access-Control-* headers it responds with, so you can see how its CORS policy actually behaves.

How it works

Browsers won't let JavaScript set an arbitrary Origin header on its own requests, so a page can't fake this test by itself. Instead, the request goes through a small Next.js API route: the server makes the HTTP call (OPTIONS, GET, POST, etc.) with your chosen target and Origin, then reads the raw response headers and hands the Access-Control-Allow-Origin, -Methods, and related headers back to the page for display.

SysAdmin & security use cases

• »Check whether your frontend's actual domain is allowed to call a separate API you deploy, before shipping.
• »Catch an API that reflects back whatever Origin it's sent instead of checking it against an allowlist — a common misconfiguration.
• »Verify a CDN or storage bucket is sending the CORS headers a browser needs to load fonts or assets from it.
• »Figure out why a preflight request is failing by seeing exactly which methods or headers the server actually permits.