CORS Headers Generator

Configure Access-Control headers visually and get ready-to-paste code for Express, Nginx, Apache, and Flask.

Last reviewed: April 2026

Reviewed by Shannon Patterson, software engineer · last updated April 2026

New to this tool? Click here for instructions

Allowed Origins - which domains can call this API

Allowed Methods

Access-Control-Allow-Headers - request headers clients can send

Access-Control-Expose-Headers - response headers browsers can read

Access-Control-Max-Age - preflight cache (seconds)

Access-Control-Allow-Credentials: true - allows cookies and auth headers

Simulate an OPTIONS preflight request and see the expected server response based on your current configuration.

Request Origin

Request Method

Request Headers

CORS Flow Explained

1. Browser sends preflight (OPTIONS) Sends Origin, Access-Control-Request-Method, and Access-Control-Request-Headers to the server.

2. Server responds to preflight Must include Access-Control-Allow-Origin, Allow-Methods, Allow-Headers. May include Max-Age for caching.

3. Browser sends actual request If preflight succeeded, the browser sends the real GET/POST/etc. with the Origin header.

4. Server responds with CORS headers again The actual response must also include Access-Control-Allow-Origin (and Allow-Credentials if applicable).

Headers Reference

Header	Direction	Description
Access-Control-Allow-Origin	Response	Allowed origins. * for all, or specific URL.
Access-Control-Allow-Methods	Preflight Response	Comma-separated list of allowed HTTP methods.
Access-Control-Allow-Headers	Preflight Response	Headers the client is allowed to send.
Access-Control-Expose-Headers	Response	Response headers the browser JS can read.
Access-Control-Max-Age	Preflight Response	Seconds to cache preflight result.
Access-Control-Allow-Credentials	Response	Allow cookies/auth. Incompatible with * origin.
Origin	Request	Sent by browser on cross-origin requests.
Access-Control-Request-Method	Preflight Request	Method the actual request will use.
Access-Control-Request-Headers	Preflight Request	Headers the actual request will include.

Configure origins and methods above to generate CORS headers.

Output

Configure options above to generate code.

How to Use the CORS Header Builder

To use the CORS Header Builder, follow these steps:

1. Simple Mode: Enter the allowed origin (or click 'Allow All' for '*'), select the HTTP methods, and copy the generated headers.

2. Advanced Mode: Configure additional headers such as Allow-Headers for custom request headers, Expose-Headers for response headers your client reads, Max-Age to cache the preflight, and the Allow-Credentials flag.

3. Preflight Check: Enter the request origin, method, and headers your client sends, then click 'Simulate Preflight' to see exactly what your server needs to respond with.

4. Copy Code Snippets: Switch between Express.js, Nginx, Apache, and Flask tabs to get ready-to-paste server configuration for your stack.

When to Use the Tool in Real Workflows

Use the CORS Header Builder when you need to configure CORS headers for your web applications to allow cross-origin requests. This is particularly useful when developing APIs that need to be accessed by different domains.

How It Works

The CORS Header Builder allows you to visually configure CORS headers for your web applications. You can specify allowed origins, methods, headers, and other options. The tool then generates the appropriate CORS headers and code snippets for various server environments such as Express.js, Nginx, Apache, and Flask.

Tips, Edge Cases, or Limitations

1. Access-Control-Allow-Origin: Be cautious when using the wildcard (*) with credentials. It is not recommended as it can expose your API to security risks. Instead, specify a specific origin.

2. Access-Control-Allow-Credentials: This flag cannot be used with the wildcard (*) origin. If you need to allow credentials, set a specific origin.

3. Preflight Cache: The Access-Control-Max-Age header allows you to cache the preflight response for a specified number of seconds. This can improve performance by reducing the number of preflight requests.

Frequently Asked Questions

CORS (Cross-Origin Resource Sharing) is a security feature implemented by web browsers to prevent web pages from making requests to a different domain than the one that served the web page.

A preflight request is an HTTP OPTIONS request that the browser sends to the server before making a cross-origin request. It is used to determine whether the actual request is safe to send.

No, you cannot use the wildcard (*) with credentials. It is not recommended as it can expose your API to security risks. Instead, specify a specific origin.

The Access-Control-Max-Age header specifies the number of seconds that the preflight response can be cached by the browser. This can improve performance by reducing the number of preflight requests.

The browser sends the following headers in a preflight request: Origin, Access-Control-Request-Method, and Access-Control-Request-Headers.