CORS Header Builder

Build Cross-Origin Resource Sharing (CORS) headers for your web APIs with output in multiple server formats

All processing happens in your browser. No data is uploaded.

Offline Ready

CORS Header Builder

Build Cross-Origin Resource Sharing (CORS) headers for your web APIs with output in multiple server formats

🔒All processing happens in your browser. No data is uploaded.

Presets

Access-Control-Allow-Origin

Security Warning

Using wildcard (*) allows any website to make requests to your API. This is fine for public APIs but risky for APIs with sensitive data.

Access-Control-Allow-Methods

GET

POST

PUT

DELETE

OPTIONS

Headers

Access-Control-Allow-Headers

Access-Control-Expose-Headers

X-Total-Count, X-Page-Count

Options

Allow CredentialsAllow cookies and authorization headers in cross-origin requests

Preflight Max AgeHow long (in seconds) browsers should cache preflight responses

Output Format

HTTP Headers

Generated CORS Configuration

Access-Control-Allow-Origin

Access-Control-Allow-Methods

Access-Control-Allow-Headers

Access-Control-Max-Age

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400