CORS Policy Builder
Configure cross-origin response headers and server snippets entirely in your browser
CORS configuration
Choose which origins, methods, and headers your server should allow.
Enter one origin per line.
Permit cookies and authorization credentials.
Generated policy
Copy the format that matches your application or server.
Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Expose-Headers:
Access-Control-Allow-Credentials: false
Access-Control-Max-Age: 86400Privacy: your policy is generated locally. No origins, headers, or configuration data leave your browser.
About this tool
CORS (Cross-Origin Resource Sharing) is the browser security protocol that decides whether code running on one origin may read a response from another. A working policy coordinates the allowed origin, methods, request headers, exposed response headers, credentials, and preflight cache duration; a mismatch in any one of them can block a valid frontend or expose an API more broadly than intended.
CORS Policy Builder turns those choices into three practical outputs: raw Access-Control response headers, Nginx add_header directives, and a JavaScript fetch example. Multiple origins require dynamic server logic because Access-Control-Allow-Origin accepts only one origin or a wildcard. For credentialed requests, the server must validate the incoming Origin against an allowlist before echoing it and cannot return *.
Generation is fully client-side, so origin allowlists and API header names never leave your browser. The output is a configuration aid: apply it to the route that handles both the actual request and its OPTIONS preflight, then verify the response in browser developer tools.
How to use
Set origins and methods
Enter one allowed origin per line and toggle the HTTP methods your cross-origin clients may use.
Configure header access
List the request headers accepted by your server and the response headers browser code may read.
Choose credentials and caching
Enable credentials only for trusted explicit origins, then set how long browsers may cache a successful preflight.
Copy the policy
Use the Headers, Nginx, or fetch example tab and copy the generated format you need.
Generated CORS formats
| Format | Use |
|---|---|
| Headers | Raw Access-Control response-header lines for documentation or middleware |
| Nginx | add_header directives for an Nginx server or location block |
| fetch example | Browser request snippet using mode: cors and the chosen credential behavior |
Generated locally — no origin or API configuration is uploaded.
Frequently asked questions
Related tools
CSR Decoder
Decode a PEM Certificate Signing Request (PKCS#10) in your browser — inspect its subject, public key, signature algorithm and subject alternative names.
License Generator
Generate open-source license files — MIT, Apache 2.0, GPL 3.0, ISC, MPL 2.0, BSD-3-Clause and Unlicense — with year, holder and project filled in.
RSS Feed Generator
Build a valid RSS 2.0 feed XML from a channel title, link, description and a dynamic list of items — escape special characters and copy or download
HTTP Security Header Checker
Audit pasted HTTP response headers for HSTS, CSP, clickjacking, MIME sniffing, referrer, permissions, and opener protections