Build CORS

Build CORS response headers for allowed origins, methods, headers, and credentials.

freeworks offlinenothing uploaded
ToolCORS Builder
Input
Output
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

Origin allowlists, methods, headers, credentials, max-age, and exposed fields become Access-Control-Allow-* headers. Browsers compare them with the request Origin and preflight result before exposing a response to script.

  • Explicit origins are safer than wildcard access.
  • Credentials remain opt-in.

Worked example

API CORS headers with credentials for specific origin
Build CORS headers allowing a specific frontend origin with credentials and common HTTP methods
Input
											Allow origin: https://app.example.com
Allow methods: GET, POST, PUT, DELETE
Allow headers: Content-Type, Authorization
Expose headers: 
Allow credentials: true
Max age: 3600
										
Output
												# CORS Response Headers
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 3600
# Express.js (Node.js)
app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', 'https://app.example.com');
  res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
  res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
  res.header('Access-Control-Allow-Credentials', 'true');
  res.header('Access-Control-Max-Age', '3600');
  if (req.method === 'OPTIONS') return res.sendStatus(204);
  ne…
											

When to use this

APIs serving separate frontends, browser JSON requests, and CDNs build CORS policy.

Edge cases

  • Wildcard origin cannot accompany credentials.
  • Non-simple headers trigger OPTIONS preflight.
  • Reflecting an unvalidated Origin trusts attacker input.

References