CORS Tester

CORS (Cross-Origin Resource Sharing) is a web standard that allows servers to specify which origins can access their resources. It's a security mechanism that relaxes the same-origin policy, enabling legitimate cross-origin requests while blocking malicious ones. Essential for modern web applications that need to communicate with APIs across different domains.

Browsers automatically send preflight requests for "complex" CORS requests: those using methods other than GET/POST/HEAD, requests with custom headers, or POST requests with content-types other than application/x-www-form-urlencoded, multipart/form-data, or text/plain.

Key headers include Access-Control-Allow-Origin (specifies allowed origins), Access-Control-Allow-Methods (permitted HTTP methods), Access-Control-Allow-Headers (custom headers allowed), Access-Control-Allow-Credentials (whether cookies/auth can be included), and Access-Control-Max-Age (preflight cache duration).

Test both simple and preflight scenarios: start with GET requests, then test POST with JSON content-type, add custom headers, test with credentials, verify error handling, and simulate requests from different origins including localhost, staging, and production domains.

Never use wildcard (*) with credentials, specify exact origins instead of wildcards when possible, limit allowed methods and headers to minimum required, implement proper authentication, validate all input data, and regularly audit CORS policies for unnecessary permissions.

Use browser DevTools Network tab to inspect preflight and actual requests, check for missing CORS headers in responses, verify request/response patterns, test with tools like this CORS tester, examine server logs for rejected requests, and validate configuration against CORS specifications.

Most modern frameworks provide CORS middleware: Express.js uses cors package, Django has django-cors-headers, Spring Boot has @CrossOrigin annotations, ASP.NET Core has built-in CORS support. Each provides granular control over origins, methods, headers, and credentials.

Preflight requests add network overhead but can be cached using Access-Control-Max-Age header (up to 86400 seconds). Optimize by minimizing custom headers, using simple requests when possible, implementing efficient preflight caching, and avoiding unnecessary CORS complexity.