CORS Policy Tester

Test Cross-Origin Resource Sharing configuration — fire preflight and simple requests and inspect headers

Enter an endpoint and the tester sends simple and preflight (OPTIONS) requests, then shows the Access-Control-* headers returned. Use it to confirm which origins, methods and headers an API allows and to spot overly permissive wildcard policies. More free security tools.

CORS policies are enforced by browsers. This tool fires real preflight and direct requests from your browser, plus uses a proxy cascade to inspect server headers when direct CORS requests are blocked.

Target URL

Origin (simulated)

Request Method

Custom Request Header (optional)

How It Works & Why It Matters

Cross-Origin Resource Sharing is enforced by the browser, not the server, which makes it hard to debug from the server side alone. A failing request often looks identical to a successful one in server logs — the difference is entirely in which Access-Control-* response headers the browser decides to honour.

This tester sends both a simple request and, where applicable, the OPTIONS preflight a browser issues before certain cross-origin requests, then shows exactly which Access-Control-Allow-Origin, -Methods, -Headers and -Credentials values the server returned. A wildcard Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true is invalid per spec and a common sign of a misconfigured API that's more permissive than intended.

Need to audit and harden your API security posture?

If you like this tool, Speak with OneFirewall