Security Tools

CORS Header Generator

Enter your allowed origin, methods, and headers to generate the CORS response headers to add to your server.

Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 600

These are response headers your server needs to send — this tool doesn't configure a live server, it just generates the header text for you to add.

How to use this tool

  1. 1Enter the allowed origin.
  2. 2Enter allowed methods and headers.
  3. 3Toggle credentials and set a max age.
  4. 4Copy the generated headers.

Frequently asked questions

Can I use a wildcard origin with credentials?+

No — browsers reject Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true. Use a specific origin if credentials are needed.

Related tools