What is CORS?

CORS (Cross-Origin Resource Sharing) is how a server tells browsers which other websites may read its responses. By default, JavaScript on https://app.example.com can send a request to https://api.example.com, but the browser hides the answer unless the API replies with an Access-Control-Allow-Origin header that names the page's origin, or *.

For anything beyond a plain GET or a simple form POST, such as a PUT, a DELETE or a JSON body with an Authorization header, the browser first asks permission with a preflight: an OPTIONS request listing the method and headers it wants to use. Only if the server's answer allows them does the real request go out.

Tool description

Enter the URL your page calls, the page's origin, the method and any custom request headers, then press Check CORS. Our server sends the same requests a browser would and applies the browser's rules to the answers:

  • The preflight (OPTIONS) with Access-Control-Request-Method and Access-Control-Request-Headers
  • A GET with the Origin header, to read the CORS headers of a normal response

The checks show which rule passes or fails, and the table lists every CORS header from both answers. The method you pick is never sent, so checking a DELETE endpoint deletes nothing.

The tool also says whether requests with cookies would work. Those need the exact origin instead of * and Access-Control-Allow-Credentials: true.

AI assistants connected to the Rapid Tool Set MCP server can run the same check as cors_checker.

Tips

  • CORS errors come from the browser, not the server. A request that works in curl or Postman can still be blocked in the browser, because those tools don't apply CORS.
  • If the preflight answers with 401 or 404, the server is treating OPTIONS like a normal request. Let preflights through before your auth checks.
  • When the server picks the allowed origin per request, it should also send Vary: Origin, or a CDN may serve one site's answer to another.