CORS Header Generator

Generate CORS configuration headers for your server. Export as raw headers, Express.js, Nginx, or Apache config.

Raw HTTP Headers
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 3600

Frequently Asked Questions

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls how web pages from one origin can request resources from a different origin. It uses HTTP headers to tell browsers which cross-origin requests should be permitted.
CORS errors occur when your frontend JavaScript makes a request to a different domain, port, or protocol than the one serving your page, and the server does not include the appropriate CORS headers in its response. The browser blocks the response to protect the user.
A preflight request is an OPTIONS request automatically sent by the browser before certain cross-origin requests (those with custom headers, non-simple methods like PUT/DELETE, or specific content types). The server must respond with appropriate CORS headers to allow the actual request.
Using a wildcard (*) allows any origin to access your resource. This is fine for public APIs without credentials, but if your API uses cookies or authentication, you must specify exact origins. Wildcard cannot be used with Access-Control-Allow-Credentials: true.
Access-Control-Max-Age specifies how long (in seconds) the results of a preflight request can be cached by the browser. Setting a higher value reduces the number of preflight OPTIONS requests, improving performance. Common values are 3600 (1 hour) or 86400 (24 hours).