Build CORS response headers for allowed origins, methods, headers, and credentials.
The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.
Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.
Origin allowlists, methods, headers, credentials, max-age, and exposed fields become Access-Control-Allow-* headers. Browsers compare them with the request Origin and preflight result before exposing a response to script.
Allow origin: https://app.example.com Allow methods: GET, POST, PUT, DELETE Allow headers: Content-Type, Authorization Expose headers: Allow credentials: true Max age: 3600
# CORS Response Headers
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 3600
# Express.js (Node.js)
app.use((req, res, next) => {
res.header('Access-Control-Allow-Origin', 'https://app.example.com');
res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
res.header('Access-Control-Allow-Credentials', 'true');
res.header('Access-Control-Max-Age', '3600');
if (req.method === 'OPTIONS') return res.sendStatus(204);
ne…
APIs serving separate frontends, browser JSON requests, and CDNs build CORS policy.