Origin Rules
Build explicit or wildcard origin policies.
CORS Header Generator
Generate Access-Control-Allow-Origin, methods, headers, credentials, and preflight snippets.
CORS HeadersExpress SnippetWorker Snippet
CORS headers
Generate CORS headers and framework snippets for API routes.
Policy
HTTP headers
Raw response headers for any server.
Access-Control-Allow-Origin: https://app.example.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Max-Age: 86400 Access-Control-Expose-Headers: Content-Length
Express
app.use((req, res, next) => {
res.setHeader('Access-Control-Allow-Origin', 'https://app.example.com');
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
res.setHeader('Access-Control-Max-Age', '86400');
res.setHeader('Access-Control-Expose-Headers', 'Content-Length');
if (req.method === 'OPTIONS') return res.sendStatus(204);
next();
});Cloudflare Worker
const corsHeaders = {
'Access-Control-Allow-Origin': 'https://app.example.com',
'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
'Access-Control-Allow-Headers': 'Content-Type, Authorization',
'Access-Control-Max-Age': '86400',
'Access-Control-Expose-Headers': 'Content-Length',
};
export default {
async fetch(request) {
if (request.method === 'OPTIONS') {
return new Response(null, { status: 204, headers: corsHeaders });
}
return new Response('OK', { headers: corsHeaders });
},
};Capabilities
What this tool handles
Use CORS Header Generator to check the input, tune the settings, and copy a clean output.
Credential Checks
Avoid wildcard origins when credentials are enabled.
Code Snippets
Copy Express and Cloudflare Workers examples.
Workflow
Run it in three steps
Build CORS headers and API snippets.
1
Set Origin
Enter the allowed origin or wildcard origin for public APIs.
2
Choose Methods
Select allowed methods, request headers, credentials, and max age.
3
Copy Code
Copy raw headers or Express and Cloudflare Worker snippets.
Good for
Common jobs this tool supports
CORS HeadersGenerate common Access-Control headers
Credential GuardWarns about wildcard credential issues
API SnippetsExpress and Worker examples
Copy OutputCopy headers quickly
FAQ
Answers before you run it
Practical notes about output, privacy, and common settings.
No. Browsers reject credentialed CORS requests when Access-Control-Allow-Origin is wildcard. Use an explicit origin instead.
Use next