CORS Header Generator
Generate CORS headers — raw headers, JSON, Nginx, Apache, or Express — with a live preview and config validation (wildcard + credentials, etc.).
About this ToolHow it works, benefits & use casesTap to collapse
Configure Cross-Origin Resource Sharing once and get the exact headers — or server config — for the stack you deploy on. Enter your allowed origins, methods, request headers and exposed headers as comma-separated lists, set Max-Age, and toggle credentials, then pick an output format: raw Access-Control-* headers, a JSON object of those headers, an Nginx block, an Apache mod_headers block, or Express.js cors middleware code. The output regenerates live as you type. Built-in validation catches the classic mistakes: a wildcard origin combined with credentials is rejected outright, and you get warnings for wildcard origins in production, a Max-Age above 24 hours that browsers may ignore, and non-standard wildcard methods. Quick Permissive, Restrictive and API presets give you sensible starting points. The Nginx and Apache outputs even include origin-matching logic and preflight handling.
How to Use
- 1Enter Allowed origins (comma-separated), or use a preset; add Allowed methods like GET, POST, PUT, DELETE.
- 2Fill in Allowed headers and any Exposed headers, set Max age (seconds), and toggle "Allow credentials" if cookies/auth must be sent.
- 3Choose an Output format: Raw headers, Headers (JSON), Nginx config, Apache config, or Express.js.
- 4Read any validation errors or warnings — for example a wildcard origin with credentials is blocked.
- 5Click "Generate CORS config", then copy or download the output (file name and type match the format).
Key Benefits
- Five output formats: raw headers, JSON, Nginx, Apache, and Express.js cors middleware
- Live preview that updates as you edit origins, methods, headers and options
- Validation blocks the unsafe wildcard-origin + credentials combination
- Warnings for production wildcards, over-24h Max-Age, and non-standard wildcard methods
- Permissive, Restrictive and API presets for fast, sensible starting configs
- Nginx and Apache outputs include dynamic origin matching and preflight handling
- Runs entirely in the browser; download uses the correct file name and MIME type per format
Common Use Cases
- Generating the Access-Control-* headers to return from an API for a known set of front-end origins
- Producing an Nginx or Apache snippet to enable CORS at the reverse-proxy layer
- Scaffolding Express cors() middleware options for a Node backend
- Double-checking that a credentialed CORS setup does not illegally use a wildcard origin
- Comparing a permissive dev config against a restrictive production config using the presets
CORS configuration
Live preview · headers
Access-Control-Allow-Origin: https://example.com Access-Control-Allow-Methods: GET, POST, PUT, DELETE Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Max-Age: 86400
Was this tool helpful?
Share Your Experience
Help others discover this tool!
Related guide
Related tools
- JSON FormatterFormat and validate JSON with syntax highlighting
- Intersection Observer GeneratorGenerate IntersectionObserver code from a use-case picker (reveal, lazy-load, infinite scroll, scroll-spy, sticky, video autoplay) with a live trigger-zone diagram and vanilla/React/Vue output
- Security Headers GeneratorGenerate hardened HTTP security headers with a live A+ to F grade, then export to nginx, Apache, Caddy, Vercel, Netlify, Next.js, Express, or Cloudflare; or audit a site's existing headers
- XSS DetectorScan input for XSS vectors by category and severity, encode it safely for any context (HTML, attribute, JS, URL, CSS), and browse a payload and sanitization reference
- AWS S3 Policy GeneratorBuild an S3 bucket IAM policy from statements (effect/principal/actions/conditions) + CORS, with a security audit that flags risky public access
- Content Security Policy GeneratorBuild a CSP directive by directive with per-source pickers, nonces, presets, a live audit, and export to header, meta tag, nginx, Apache, Vercel, Netlify, Next.js, or Express
Five: raw Access-Control-* response headers, the same headers as a JSON object, an Nginx configuration block, an Apache mod_headers block, and Express.js cors middleware options. The live preview switches instantly when you change the Output format dropdown, and downloads use a matching file name like cors.conf or cors.js.
The CORS specification forbids combining Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true — browsers will refuse the response. The validator surfaces this as a blocking error so you fix it before shipping, typically by listing explicit origins instead of the wildcard.