Softonic

CORS Tester

Step 1 / 3
Next

CORS errors are the “classic” browser console red: you hit an API from a different origin and the browser blocks the response. This tester sends a preflight OPTIONS request to any URL you paste, using the origin and method you choose, then decodes the Access-Control-* headers so you can see exactly what the server is allowing, what it is blocking, and why the browser complains.

How to test CORS

  1. 1

    Enter the target URL

    The API endpoint you want to call from your front-end. Include query string and protocol.

  2. 2

    Set the method and origin

    GET/POST/PUT/DELETE/PATCH. Origin can be your site URL or any origin you want to simulate.

  3. 3

    Understand the preflight

    The tester always sends an OPTIONS request with the origin and method you chose, plus an Access-Control-Request-Headers: Content-Type header, exactly the preflight a browser sends before a JSON request.

  4. 4

    Run the test

    The tester sends the preflight and reports the HTTP status plus the CORS response headers: Allow-Origin, Allow-Methods, Allow-Headers, Allow-Credentials and Max-Age.

  5. 5

    Fix the misconfiguration

    The report flags what is missing or wrong: missing Allow-Origin, forbidden header, method not allowed.

The headers that matter

Header What it does
Access-Control-Allow-Origin Which origins may read the response
Access-Control-Allow-Methods Preflight: which methods are allowed
Access-Control-Allow-Headers Preflight: which request headers are allowed
Access-Control-Allow-Credentials Whether cookies/auth are allowed
Access-Control-Expose-Headers Which response headers JS can read
Access-Control-Max-Age How long the preflight result is cached

Simple vs. preflighted requests

A request is “simple” (no preflight) only if all of these are true:

  • Method is GET, HEAD, or POST.
  • Headers are limited to Accept, Accept-Language, Content-Language, Content-Type (with specific values).
  • Content-Type, if present, is application/x-www-form-urlencoded, multipart/form-data, or text/plain.

Anything else, a JSON body, an Authorization header, a custom X-Foo header, a PUT/DELETE/PATCH, triggers a preflight OPTIONS. Servers must answer the preflight with the right Allow-* headers or the real request never fires.

Common CORS failures

  • “No Access-Control-Allow-Origin header” → server does not set the header. Fix at the server, not the client.
  • “Credentials mode requires Allow-Origin not to be *” → if you send cookies, Allow-Origin must be a specific origin (or echo the Origin header).
  • “Request header X not allowed” → add X to Access-Control-Allow-Headers on the preflight response.
  • “Method not allowed” → add the method to Access-Control-Allow-Methods.
  • “Redirect not allowed in preflight” → preflight cannot follow redirects. The OPTIONS endpoint must respond directly.

Allow-Origin: * vs. echoing Origin

Access-Control-Allow-Origin: * is permissive but cannot be combined with credentials. In production, echo the request Origin back (after validating against an allowlist) and set Allow-Credentials: true if you need cookies.

Proxying as a workaround

If you cannot control the server, a thin proxy on your own domain strips CORS entirely, the browser sees same-origin. Many hosting platforms (Vercel, Netlify, Cloudflare) offer rewrite rules for exactly this.

Frequently Asked Questions

To prevent a malicious page from reading private data on another site using your browser’s cookies. Without CORS, visiting evil.com could let it request your bank’s internal API as you. CORS forces the bank to explicitly permit cross-origin reads.

Only in development. Chromium has a --disable-web-security flag but it affects all sites and is dangerous. The correct fix is server-side headers or a proxy.

Postman is not a browser, it ignores CORS entirely. CORS is enforced only by browsers for JavaScript requests. A server that works in Postman is not automatically CORS-correct.

Images and classic <script> tags load cross-origin without CORS, but JS cannot read their contents. <img crossorigin> and fetch() do enforce CORS, which is why canvas-drawn images go “tainted” without it.

Related Tools

What Is My IP

See the IP address this server received for your request, its IPv4 or IPv6 family, and an approximate country when local GeoIP data is available.

IP Address Lookup

Look up any public IPv4 or IPv6 address for approximate country, region, city, coordinates, ISP, ASN, organization and timezone.

Speed Test

Run a fast, free, browser-based internet speed test. Measure your download speed in Mbps plus round-trip latency and jitter, and see whether your connection is ready for 4K streaming, gaming and video calls, no app, no signup.

WHOIS Lookup

Look up public WHOIS registration data for a domain: registrar, nameservers, status codes and expiry dates.

DNS Lookup

Query the A, AAAA, MX, TXT, NS, CNAME and SOA records of any domain without opening a terminal.

Email Header Analyzer

Analyze raw email headers privately in your browser. Review Received hops, timing, SPF, DKIM, DMARC and ARC metadata without uploading a message.