CORS Header Builder
CORS Header Builder
Build correct Access-Control-* response headers for any CORS configuration. Toggle methods, set allowed/exposed headers, enable credentials mode, and get nginx and Express.js code snippets.
Use
* for public APIs, or a specific origin when using credentials. Comma-separated request headers the browser may send.
Response headers JS can read beyond the safe defaults.
Allow CredentialsPermits cookies and auth headers. Requires a non-* origin.
Preflight (OPTIONS) response headers
Access-Control-Allow-Origin: *
Allows any origin. Cannot be used with credentials.
Access-Control-Allow-Methods: GET, POST, OPTIONS
HTTP methods the browser is allowed to use in the actual request.
Access-Control-Allow-Headers: Content-Type, Authorization
Request headers allowed in the actual request.
Access-Control-Max-Age: 86400
Browser may cache the preflight result for 86400 seconds.
Actual request response headers
Access-Control-Allow-Origin: *
Tells the browser which origin is allowed to read the response.
CORS Header Builder
Build correct Access-Control-* response headers for any CORS configuration. Toggle methods, set allowed/exposed headers, enable credentials mode, and get nginx and Express.js code snippets.
Common uses
- Build CORS headers for an API with specific origins
- Get a ready-to-paste Express.js CORS snippet
Frequently asked questions
Can I use CORS Header Builder to build CORS headers for an API with specific origins?
Yes. CORS Header Builder can build CORS headers for an API with specific origins, directly in your browser.
Can I use CORS Header Builder to get a ready-to-paste Express.js CORS snippet?
Yes. CORS Header Builder can get a ready-to-paste Express.js CORS snippet, directly in your browser.
Is my data uploaded to a server?
No. This tool runs entirely in your browser — your input is processed locally on your device and is never uploaded or stored on a server.