CORS Header Builder

Compose explicit CORS response headers for browser APIs and preflight requests.

Allowed origin

Avoid * when credentials are enabled.

Allowed methods

Allowed headers

Preflight cache (seconds)

Allow credentials

Response headers

HTTP · 4 lines

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 600

CORS is enforced by browsers; configure headers on your server or edge runtime.

How this tool works

CORS Header Builder

How it works

Privacy