CORS Configuration Generator
Set allowed origins, methods, headers, credentials and preflight caching, and get Laravel's config/cors.php, an Nginx block, Express options or the raw headers.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a CORS configuration
Output
Configuration
476 characters
The response may name only one origin, so a server allowing several echoes back the request's Origin when it is on the list, and must send Vary: Origin so a cache does not hand one site's answer to another. CORS is enforced by browsers: it protects users, not your API from curl.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
What CORS is for
Browsers stop a page from reading responses from another origin unless that origin agrees through CORS headers. It protects users' cookies and data from being read by other sites; it does nothing to stop a script or curl calling your API directly.
Preflights
A request with a JSON body, an Authorization header or a method other than GET, HEAD or POST is preceded by an OPTIONS preflight. The server must answer it with the allowed methods and headers, and Access-Control-Max-Age lets the browser cache the answer. Chromium caps that at two hours.
Credentials
With cookies or Authorization allowed, the origin must be named exactly; * is rejected. A server allowing several origins checks the request's Origin against its list and echoes it back, with Vary: Origin so caches keep one answer per origin. Laravel's HandleCors middleware does this from config/cors.php.