CORS tester
Name the URL you are calling and the origin you are calling it from. We make the request from our own server and tell you which Access-Control header is missing or wrong.
The request you want to make
This one runs on our servers. We make the request from a public address and show you the headers that came back, and we never send your cookies or a body.
What CORS is, and what a preflight is
A browser will not let one origin read a response from another unless the second one says so. It says so with Access-Control-Allow-Origin on the response. For anything beyond a plain GET or POST with ordinary headers, the browser asks first with an OPTIONS request called a preflight, and only sends the real request if the answer allows the method and the headers it is about to use.
How to read the verdict
Each row is one header the browser looks at, with the value that came back beside it. A row marked as failing is a reason the request is blocked, and the banner at the top names the first one, because that is the one to fix first. Rows marked as information change nothing on their own. Underneath, the exact request we sent and the headers that came back, so you can hand the whole exchange to whoever runs the server.
Which header fixes which failure
Access-Control-Allow-Origin is the one to send first, and it has to name your origin exactly, scheme and port included, or be an asterisk. Access-Control-Allow-Methods and Access-Control-Allow-Headers only matter on the preflight, and each has to list what the browser asked for. Access-Control-Allow-Credentials has to be the literal string true before cookies are sent, and it cannot be combined with an asterisk origin. Access-Control-Expose-Headers is what lets JavaScript read anything beyond the handful of response headers browsers hand over by default.
Stop guessing which header the server did not send
A blocked request looks the same from the outside whatever caused it. Session Replay records the request, the response headers and the console line together, so the next person to look already has the whole thing.