Configure an allowed origin, credentials, methods, request headers, exposed headers, and preflight caching, then copy valid HTTP or server-specific output.
Comma-separated header names sent by the request.
Additional response headers readable by browser JavaScript.
Use 0 to omit. Browsers may cap longer values.
Cross-Origin Resource Sharing (CORS) is the browser protocol that lets a server opt into requests from a different origin. An origin is a scheme, host, and port combination such as https://app.example.com. The browser enforces CORS; adding headers to frontend JavaScript cannot grant access to a response.
Use this generator to create a focused server policy. Choose a wildcard only for genuinely public, non-credentialed resources. Choose a specific origin when an application sends cookies, HTTP authentication, or client certificates. The generator refuses the invalid combination of Access-Control-Allow-Origin: * and credentials.
A JSON API used by https://dashboard.example.com might return:
Access-Control-Allow-Origin: https://dashboard.example.com
Vary: Origin
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Max-Age: 600
Vary: Origin matters when a cache can store different responses for different request origins. A production server that dynamically reflects origins must compare the request origin with an explicit allowlist first. Never reflect arbitrary input.
Browsers send an OPTIONS preflight before certain cross-origin requests. The preflight asks whether the intended method and request headers are allowed. Access-Control-Max-Age can cache that permission, although browsers may apply their own upper limits.
This tool checks syntax and unsafe combinations, but it does not send a request to your server or prove that every route, proxy, CDN, authentication layer, and error response returns consistent headers. It also does not bypass the same-origin policy. Test the generated configuration in the actual deployment.
For adjacent response policy work, build a Content Security Policy, review a Permissions Policy, or configure Cache-Control headers.
Configuration stays in this browser tab and is not sent to MiniUtil. The generated snippets contain only the values you enter.
The authoritative browser behavior is defined by the WHATWG Fetch Standard. The origin model is specified in RFC 6454.
Share this utility
Send the tool, not any text or files you entered. Input is never added to the share URL.
Continue the workflow
Step 1 of 5. Keep the context and finish the related checks.
Keep working