↔
OneFreePlace
TOOL #396 · CORS POLICY LAB
Developer Tools · Browser security

CORS Header Builder

Design a least-privilege CORS policy, simulate real origins and preflight requests, catch wildcard/credential mistakes, and generate server code that validates origins instead of blindly reflecting them.

Local policy simulator · no requests sent

Policy

Allowed methods

Live policy check

Fetch/CORS semantics
Preflight—
Origin allowed—

Findings

CORS controls which browser scripts may read a response. It is not authentication, authorization, CSRF protection, or a firewall.

Simulated browser request

Response headers browser needs

Server implementation
Never blindly reflect Origin
Validate an exact origin against an allowlist before echoing it back.
Credentials change wildcard rules
Credentialed requests require explicit origin handling; wildcard configurations are a frequent source of broken or unsafe setups.
Vary matters
Dynamic origin responses should vary caches by Origin, and preflight responses may also vary by requested method/header set.