A verdict on one specific request
Allowed or blocked, for the exact method, headers, origin and credentials mode you describe, with the check that decided it named. Not a list of headers left for you to interpret.
CORS Checker
Find the check that blocks your cross-origin request
Would a browser let your code read this response? And if not, which check said no.
Web tool
Official product page
Publisher:
POLPROG
Official product page
6
Analysis stages
5
Report tabs
10
Origins per run
0
Request bodies sent
01/CORS Checker
About
This is a diagnosis of one request, not a header dump. You describe the call your code makes - the endpoint, the origin it runs on, the method, the headers it sets, whether it sends credentials - and the tool reports whether a browser would let you read the answer, and which specific check decided that.
What actually happens during a run
- Prepare the request exactly as described.
- Classify it as simple or preflighted, by the Fetch standard rules a browser applies.
- Test the preflight with a real OPTIONS request carrying Origin, Access-Control-Request-Method and, where needed, Access-Control-Request-Headers.
- Send the actual request, because the preflight alone never shows the CORS headers on the real response.
- Probe the origin allowlist with one extra request carrying an origin the server has never seen.
- Build the report: verdict, request flow, headers, findings and the technical exchange.
The allowlist probe
A server that answers every origin with that same origin looks identical to a correctly configured allowlist if you only ever test your own. Sending one request from an origin the server has never seen separates the two, which matters because an echoing server combined with credentials is the configuration that makes a response readable by every site its user visits.
Credentials change the rules
| Header | With credentials |
|---|---|
| Access-Control-Allow-OriginNo wildcard | Must name the origin. An asterisk is rejected outright, even alongside Access-Control-Allow-Credentials: true. |
| Allow-Methods, Allow-Headers, Expose-HeadersLiteral | An asterisk stops being a wildcard and is read as a literal header or method name. |
| Access-Control-Allow-CredentialsRequired | Its only accepted value is the exact lowercase string true. |
Findings, not adjectives
Every finding carries a severity, a category, the phase it came from, the evidence it was drawn from, the headers it concerns and a recommendation. The checks that passed are listed too, so a clean result is visible rather than merely empty. Two rules the recommendations follow, because the obvious advice is often the wrong advice: nothing here tells you to open a method, a header or an origin just to clear a red box - a blocked DELETE may be a correctly locked-down endpoint - and nothing here ever suggests reflecting an arbitrary Origin. An allowlist is the answer, every time.
What it does not claim
CORS decides which origins may read a response inside a browser. It is not authentication, it grants no permissions, and it does not stop cross-site request forgery, because a CSRF attack never needs to read the response. Any client that is not a browser ignores it entirely. This tool is explicit about that rather than letting a green verdict imply your endpoint is protected.
02/Use case
What it solves
The problem
- It works in curl and Postman, and fails in the browser
- The console says blocked by CORS policy, and not much else
- The preflight fails, so the endpoint never sees the request and the logs stay empty
The outcome
- The exact check that stops the browser, named
- A real preflight and a real request, both actually sent
- A fix that does not mean opening the endpoint up
Who it is for
- Frontend developers whose fetch call is blocked
- API teams configuring CORS across several environments
- Anyone debugging a preflight they did not write
03/Key Features
Key Features
The most important capabilities, explained in practical terms.
A real preflight and a real request
Six stages, each reported as it settles. The OPTIONS preflight is sent as a browser would send it, and the actual request follows, because the preflight alone never shows the CORS headers on the real response.
Simple or preflighted, decided properly
A request is simple only when the method is GET, HEAD or POST and every header is CORS-safelisted, with Content-Type limited to three values. The tool applies the rule rather than guessing, which is usually where the surprise OPTIONS request comes from.
The origin allowlist probe
One extra request carrying an origin the server has never seen, which separates a genuine allowlist from a server that echoes back whatever it is given. Those two look identical if you only ever test your own origin.
Credentialed requests judged by their own rules
A wildcard origin becomes invalid, and asterisks in Allow-Methods, Allow-Headers and Expose-Headers stop being wildcards and read as literal names. The analysis applies the stricter set rather than the common one.
Redirects re-checked at every hop
A browser restarts its CORS check at each redirect, so each hop is evaluated again before it is followed. A chain that ends somewhere permissive can still be blocked in the middle.
Several origins in one run
Up to ten extra origins tested against the same endpoint and shown as a table, which is the quickest way to confirm that local, staging and production are all on the allowlist and no more.
Findings with evidence and a recommendation
Each one carries a severity, a category, the phase it came from, the evidence behind it and the headers it concerns, alongside the checks that passed. No recommendation ever tells you to open a method, header or origin just to clear a warning.
04/Download
Product access
A clear path from the official source to your first successful workflow.
Choose the right platform
Use one of the official links available for your device or browser.
Install or open
Follow the store instructions or open the web application. No third-party installers.
Configure and begin
Review the options, choose your preferences and start with the core workflow.
Official access options
05/Technology
Technology behind the product
A transparent look at the core technologies used to build and maintain this product.
PHP
JavaScript
06/Security
Privacy & Security
Your data stays on your device. Always.