Skip to content
ToolQivo

CORS Header Generator

Generate correct CORS headers, and understand why the request was blocked.

Developer Tools Reviews Free · no sign-up

Quick Tool Overview

The CORS Header Generator produces the headers your server needs and explains what the browser will then permit — including the credentials rule and the preflight response that catch almost everyone out.

What it does
Generates CORS headers and explains the rules
You give it
Allowed origins, methods and headers
You get back
Headers plus Apache, nginx and Express snippets
Best for
Fixing a cross-origin request the browser is blocking
Developer Tools Free, unlimited use No sign-up Runs in your browser

About the CORS Header Generator

CORS is a browser restriction, not a server one, and almost every confusing thing about it follows from that. This generates the headers your server needs to send, with each one explained in terms of what the browser will then permit.

The rules that catch people are handled explicitly. A wildcard origin cannot be combined with credentials — browsers reject it — so if you need cookies you must echo a specific origin and add Vary: Origin so caches do not serve the wrong one. A preflight OPTIONS request must be answered before the real request is sent, and must list the methods and headers you allow. Response headers your JavaScript needs to read must be named in Access-Control-Expose-Headers, or they are invisible even though they arrived.

Key features of the CORS Header Generator

The credentials rule enforced

A wildcard origin cannot be combined with credentials, and the generator refuses the combination rather than producing a header browsers will reject.

Vary: Origin included

When a specific origin is echoed, the Vary header comes with it — without which a cache will serve one origin’s response to another.

Preflight handled

The OPTIONS response is generated too, since a missing preflight answer means the real request is never sent.

Exposed headers explained

Why your JavaScript cannot read a header that clearly arrived, and which directive fixes it.

Server config generated

Apache, nginx, Express and Laravel snippets, not just a list of header names.

How to use the CORS Header Generator

  1. 1

    Choose the allowed origins

    A wildcard for a public API, or specific origins when credentials are involved.

  2. 2

    Set methods and headers

    What the preflight response should permit for the real request.

  3. 3

    Decide about credentials

    Cookies and Authorization headers need this on, which rules out the wildcard.

  4. 4

    Take the server snippet

    Apache, nginx, Express, Laravel and a raw header list are all generated.

Frequently asked questions

Because you are also sending credentials. Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true cannot be combined — echo the specific requesting origin instead and add Vary: Origin.

Reviews of the CORS Header Generator

What people who use the CORS Header Generator think of it. Reviews come from visitors and are posted as written.

No ratings yet

Yours would be the first.

  • 5 0 reviews rated 5 stars
  • 4 0 reviews rated 4 stars
  • 3 0 reviews rated 3 stars
  • 2 0 reviews rated 2 stars
  • 1 0 reviews rated 1 star

Write a review

Used this tool? Your rating helps the next person decide.

Your rating

Plain text only — links, email addresses and HTML are not accepted. Your name and review are shown publicly; nothing else is collected. See the privacy policy.

0 reviews

Newest first

No reviews yet

Be the first to rate the CORS Header Generator. It takes half a minute and no account.

Write the first review

More developer tools