Your files stay on your device

CORS Probe: Access-Control Headers Explained

Read a URL's Access-Control-* answers as a browser enforces them, preflight included.
ProbeURL

Request method
GETHEADPOSTRequest headers (comma-separated)

Custom headers force a preflight. The probe checks the OPTIONS answer.

Browser egress

The probe rides this project's proxy server (GET/HEAD/OPTIONS, public hosts, capped, rate-limited): the browser cannot enumerate hidden cross-origin response headers to test them. This page leaves your browser only when you press the button; never on load, never in the background. Nothing is sent anywhere else, and no analytics loads on this page.

Reads the Access-Control-* answers exactly as a browser enforces them: allow-origin (wildcard vs specific), credentials, exposed headers, and, when the request needs one, the OPTIONS preflight's methods, headers, and max-age.
Nothing in yet

Paste, drop, or type to begin. Everything stays on this device.

Next door in Network

- Live HTTP headers (/network/headers)
- CSP evaluator & builder (/web/csp)
All network tools (/network)

Canonical HTML: https://nutter.tools/network/cors
Markdown version: https://nutter.tools/network/cors/index.md
Plain-text version: https://nutter.tools/network/cors/index.txt
Agent index: https://nutter.tools/llms.txt