CORS Tester
Check whether a URL sends CORS headers and understand exactly why a cross-origin browser request would succeed or fail.
Run a check to see results.
What is CORS?
CORS (Cross-Origin Resource Sharing) is a browser security mechanism that blocks a web page from reading responses from a different origin unless that origin explicitly allows it via response headers like Access-Control-Allow-Origin. It protects users from malicious pages silently reading data from other sites using the victim's cookies/session.
How this tool works
It sends a real request to the URL you provide (in cors mode, matching what any web app would do) and reports which CORS-related headers were readable from the response. For "simple" requests, the browser sends the request directly; for others (custom headers, non-simple methods) the browser first sends an automatic OPTIONS preflight request, which this tool also fires explicitly so you can see the preflight response.
Frequently Asked Questions
Why does it say "opaque / cannot read headers"?
If the server sends no CORS headers at all, the browser still lets the request complete but hides the response body and most headers from JavaScript — this shows up as a network-level success but with unreadable content, which is exactly what a real app calling that API from the browser would experience.
What does Access-Control-Allow-Credentials do?
It tells the browser whether cookies/auth headers can be included in a cross-origin request. When present, Access-Control-Allow-Origin cannot be a wildcard (*) — it must name the exact origin.
My server has CORS enabled but this still fails — why?
Double-check the allowed origin matches exactly (including scheme and port), that the allowed methods list includes the one you're testing, and that any custom headers you send are listed in Access-Control-Allow-Headers.