DEV3 Technologies home

Developer tool

CORS Checker

Test whether a browser would allow your site to call an API. We send the preflight and request, then explain every missing or wrong CORS header.

Free, no sign-up. Our server sends one OPTIONS and one GET to the URL you enter and shows the answer. Nothing is stored.

Scheme, host and port of the page that calls the API.

Comma separated, for example authorization, x-api-key, content-type

We send one OPTIONS preflight and one GET with your Origin header, nothing else. A POST, PUT or DELETE is judged from its preflight and never sent.

How to use the cors checker

Find out why the browser blocks a call

CORS errors show up in the console as a single line, and the browser hides the response that would explain them. This checker repeats the request from our server and reads the headers for you.

How to use it

  1. Enter the API URL you call from your front end.
  2. Enter your site's origin, for example https://app.example.com. It is the scheme, host and port of the page, with no path.
  3. Pick the method your code uses and list any custom headers, such as authorization or x-api-key.
  4. Complete the captcha and press Check CORS.

What happens

If the method is anything other than GET, HEAD or POST, or if you add a header that is not on the browser's safe list, a real browser first sends an OPTIONS preflight. The tool does the same and checks that:

  • the status is 2xx and not a redirect;
  • Access-Control-Allow-Origin matches your origin or is a wildcard without credentials;
  • Access-Control-Allow-Methods lists your method;
  • Access-Control-Allow-Headers covers each custom header.

It then sends a GET with your Origin header and checks the response the same way. Each check is shown as OK, warning or problem with a plain explanation.

Fixing common problems

  • Missing Allow-Origin: add the header on the API, not on your front end.
  • Preflight returns 404 or 405: the route must also answer OPTIONS.
  • Headers not allowed: add them to Allow-Headers, case does not matter.
  • Credentials: echo the exact origin and send Allow-Credentials: true.

Limits

Ten checks per minute and one hundred per day for each address.

Frequently asked questions

Why test from a server and not from my browser?

A page cannot read the headers of a blocked cross-origin response, and the console only says it failed. Our server reads the raw headers and tells you which rule broke.

Does the tool send my POST or DELETE request?

No. Only an OPTIONS preflight and a plain GET are sent. For other methods the verdict comes from the preflight answer, so nothing on the API is changed.

Which addresses can I test?

Public web addresses on standard ports. Private networks, localhost and cloud metadata addresses are refused, and redirects are checked at every step.

What does Vary: Origin do?

When the allowed origin changes per caller, caches must store a separate answer for each origin. Without Vary: Origin a CDN can hand one site the answer meant for another.

Why is a wildcard rejected with credentials?

Browsers refuse Allow-Origin: * when cookies or authorization are included. The server must repeat the exact origin and also send Allow-Credentials: true.