Security
CORS Tester
Enter a public API URL and the origin of the page that calls it. One response and one OPTIONS preflight report Access-Control-Allow-Origin, credentials, methods, headers, exposed headers, and Vary. Private API addresses are refused. Other origins are not tried, and the result is not stored.
Quick start
- 1
Enter the API URL
Use a public http or https address you are allowed to request. Private and local addresses are refused.
- 2
Enter the frontend origin
Use the page origin, such as http://localhost:5173 or https://app.example.com. The origin is sent as a header. It is not fetched.
- 3
Choose the method
GET and HEAD use the response. POST, PUT, PATCH, and DELETE also need the OPTIONS preflight to allow the method.
- 4
Read the grades
Present means the header lets this origin through. Review means the header is there but does not match. Missing means the browser would block the read.
Features
Allow-Origin
See whether the response allows the frontend origin, a wildcard, or a different site.
Preflight
Check Allow-Methods and Allow-Headers for POST, PUT, PATCH, and DELETE.
Credentials and cache
Flag a wildcard paired with credentials, and a specific origin that forgets Vary.
Specifications
- Requests
- Response plus OPTIONS
- Methods
- GET, HEAD, POST, PUT, PATCH, DELETE
- Target
- Public http or https
- Privacy
- Not stored
Use cases
- See why a local frontend cannot call an API.
- Check Allow-Methods before a PUT.
- Confirm Vary is set when the allowed origin is specific.
Frequently asked questions
Does this try other websites as the origin?
No. Only the origin you type is sent. The check does not look for an origin the server forgot to reject.