CORS Header Generator

Build Cross-Origin Resource Sharing headers for Express, nginx, Apache, or raw HTTP.

Allow-Origin: *Format: plainCredentials: Omitted

Allow-Origin

Credentials

Allow-Methods (comma-separated)

Allow-Headers (comma-separated)

Max-Age (preflight cache)

Expose-Headers

Output format

Generated output

How CORS headers work

Cross-Origin Resource Sharing (CORS) is a browser security mechanism that controls which origins can call your API. The server responds with Access-Control-Allow-Origin to approve or reject the request. For pre-flight requests (OPTIONS), the browser also checks Access-Control-Allow-Methods and Access-Control-Allow-Headers. Setting Access-Control-Max-Age caches the pre-flight result to reduce extra round-trips.

Never set Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true — browsers will reject it.

Built and maintained by Meet Shah · Last updated 13 August 2026

What this tool is used for

Producing the headers an API needs so a browser client can call it.
Working out which headers a preflight response actually requires.
Getting the credentials configuration right, which has a specific constraint.
Producing a permissive development config and a strict production one.
Checking a header set against a failing browser request.

Frequently Asked Questions

Why can't I use a wildcard origin with credentials?: Because the Fetch spec forbids it: a request carrying cookies or an Authorization header may not be answered with Access-Control-Allow-Origin: *, and the browser discards the response. Echo the specific requesting origin instead — and add Vary: Origin, or a cache will serve one site's header to another.
What is a preflight and when does it happen?: An OPTIONS request the browser sends first, to ask whether the real one is allowed. It is triggered by any method beyond GET, HEAD or POST, by most custom headers, and by a Content-Type outside the three form-ish values. Simple requests skip it, which is why some endpoints seem to need no CORS setup at all.
Is Access-Control-Max-Age respected as set?: Only up to each browser's own ceiling. Chrome caps the preflight cache at 7,200 seconds regardless of what you send, and Firefox at 86,400 — so the one-week option is silently clamped. It is still worth setting: without it, every non-simple request pays for its own preflight.
Does CORS make my API secure?: No — it is a browser restriction, not server authorisation. curl, a server-side fetch and any native app ignore it completely, so CORS only decides which web pages may read your responses. Authentication and authorisation still have to be enforced on the server.
Why is my header ignored on the error response?: Because CORS headers must be present on every response, including 4xx and 5xx. Many frameworks add them in middleware that never runs when an earlier handler throws, so the browser reports a CORS error instead of the real status — one of the most misleading failures in web development.

Common errors and gotchas

Using a wildcard origin together with credentials, which browsers reject outright.
Omitting the headers a preflight needs, so the actual request never fires.
Forgetting that the browser enforces this, so a server-to-server call is unaffected.
Reflecting the request's origin back without validating it, which is effectively a wildcard.
Shipping a development wildcard to production and exposing an authenticated API to any page.