A worked example, rendered from real sample data. Sign in to run the tool on your own input.
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400═══ Verdict — the browser would ALLOW this ═══
✓ Every CORS rule checked here passes and the response is readable by the calling page.
Request origin: (not supplied — add an Origin: header to test a specific site)
Requested method: (not supplied)
Requested headers: (none)
Credentialed: no
Preflight: not required
═══ Warnings ═══
⚠ Wildcard origin — any website can read this response. Fine for public data, wrong for anything user-specific.
═══ Notes ═══
ℹ Preflight cached for 86400s (1d). Chromium caps this at 7200s, Firefox at 86400s.
ℹ Only the six safelisted response headers are readable. Add Access-Control-Expose-Headers to surface your own.
═══ Preflight exchange this configuration implies ═══
─── Request ───
OPTIONS /your/endpoint HTTP/1.1
Origin: https://app.example.com
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type, authorization
─── Expected response ───
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT
Access-Control-Allow-Headers: content-type, authorization
Access-Control-Max-Age: 86400
Vary: Origin
═══ Response headers seen (4) ═══
access-control-allow-origin: *
access-control-allow-methods: GET, POST, PUT
access-control-allow-headers: Content-Type, Authorization
access-control-max-age: 86400
Analyze CORS response headers for misconfigurations and security issues. Part of the DevTools Surf developer suite. Browse more tools in the Networking collection.