Runs in your browser
CORS Tester
Run a real cross-origin request from your browser against any endpoint and see which Access-Control headers come back, what each one means, and whether the request was allowed or blocked. Because the browser sets the Origin header itself, this reports what a browser actually does — not what a server-side proxy would see.
This runs a real cross-origin request from your browser, with
Origin: this site. Because the browser sets the Origin header itself, a test here tells you whether this page’s origin is allowed — an endpoint that allows your app specifically may still fail here, and that is a correct result, not a bug.Origin is a forbidden header name — scripts cannot change it, so this is fixed to the page’s own origin.
Adding a non-safelisted header forces the browser to send a CORS preflight (OPTIONS) request first — a useful way to test whether the server handles preflight correctly.
Enter a URL and run the test to see which CORS headers the endpoint returns.
ReadyDeveloper UtilitiesFree · No account required
Related tools
Features
- Real browser request — not a server-side proxy pretending to be one
- All six Access-Control response headers, each explained
- Credentialed-request mode, including the wildcard-origin rule
- Custom headers to force a preflight
How to use
- Enter the endpoint URL and pick a method.
- Add any custom headers your real request sends.
- Run the test and read the per-header explanation.
FAQ
- Why can't I set a custom Origin?
- Origin is a forbidden header name — browsers set it themselves and scripts cannot override it. Any tool that lets you type an arbitrary Origin is sending the request from a server, which tests something different from what your browser will actually do.
- The test failed, but my API works in Postman. Why?
- Postman and curl aren't browsers and don't enforce CORS at all. CORS is a browser rule, so an endpoint can work perfectly in an API client and still be unreachable from front-end code — which is exactly the case this tool detects.
- Why is Access-Control-Allow-Origin shown as not visible?
- Browsers don't expose that header to JavaScript, even on a successful request. If the request completed at all, the server did send an acceptable value — the header's absence here is a browser restriction, not a server problem.
- How do I test a preflight request?
- Add a non-safelisted request header, or use a method like PUT or DELETE. That forces the browser to send an OPTIONS preflight first, so a server that mishandles preflight will fail here.