Security
CORS Config Generator/Explainer
Generate the CORS response headers you need, with a plain-English explanation of each one and a real check for the wildcard + credentials trap.
Allowed methods
Allow credentials (cookies / auth headers)?
Generated response headers
Access-Control-Allow-Origin: https://example.com Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Origin
Tells the browser which origin(s) are allowed to read this response. Without a matching value here, the browser blocks the cross-origin response from reaching your JavaScript, even if the server sent it fine.
Access-Control-Allow-Methods
Lists the HTTP methods the server permits for cross-origin requests. For "non-simple" methods (PUT, DELETE, PATCH, or custom headers), the browser sends a preflight OPTIONS request first and checks this header before sending the real request.
Access-Control-Allow-Headers
Lists which request headers the client is allowed to send in the actual request (e.g. Authorization, Content-Type). Checked during the preflight response, just like Allow-Methods.
Access-Control-Allow-Credentials
When set to true, allows the browser to include cookies, HTTP auth, and TLS client certs on the cross-origin request, and allows JS to read the response when credentials were sent. It only works paired with a specific origin - never with a wildcard.
Vary: Origin
Tells caches (browser, CDN, proxy) that the response varies based on the Origin request header, so a cached response for one origin is never served to a different origin.
Generated headers are a starting point - always confirm against your framework or proxy's actual CORS handling before shipping.
This is one question. ArchSetu answers it for a whole repository.
Call graph, dead code, blast radius and a health score, in about a minute.
Related tools
All Security tools →Was this tool helpful?