CORS Preflight Tester
Test CORS preflight requests on any URL with our free CORS Preflight Tester. Run a live check from your browser to see whether a cross-origin request with your custom headers gets through, then use the generated curl command to send the exact OPTIONS preflight for any origin and HTTP method. Paste its output back and the tool analyzes 6 CORS headers with a pass/fail verdict for each check, helping you diagnose CORS configuration issues quickly. No signup required.
Quick Test Presets
These headers (with their values) are sent to the target URL in the live check.
Why Use Our CORS Preflight Tester?
Live Cross-Origin Check from Your Browser
Send a real GET or HEAD with your custom headers to any URL from this site. The CORS Preflight Tester uses the browser's fetch API, so the browser runs the real preflight when one is needed - just like before any cross-origin request from your app. The result shows whether CORS let the request through, plus the response headers this page is allowed to read.
Comprehensive CORS Header Analysis
Paste the output of the generated curl preflight and the tool analyzes 6 key Access-Control-* response headers: Allow-Origin (checks origin matching), Allow-Methods (validates the HTTP method), Allow-Headers (verifies custom headers), Allow-Credentials (checks cookie/auth support), Max-Age (preflight caching duration), and Expose-Headers (client-readable headers). Each check shows pass/fail with detailed explanations.
curl Preflight for Any Origin
Browsers hide preflight responses from web pages, so the tool generates the exact OPTIONS preflight as a curl command - with any Origin, method and request headers - and analyses the output when you paste it back. You see the server's real Access-Control-* headers even when it does not allow this site.
Free & No Signup Required
Test CORS preflight requests on unlimited URLs with no signup, no API key, and no usage limits. All requests go directly from your browser to the target server - no proxy is involved. We do not store, log, or process any test data on our servers. Completely free, forever.
Common Use Cases for CORS Preflight Testing
API Integration Debugging
Frontend developers testing API integrations use the CORS Preflight Tester to diagnose CORS errors. When a browser console shows "CORS policy: No 'Access-Control-Allow-Origin' header", use the tester to run a live check, then run the generated curl preflight to see exactly which CORS headers the server returns - and which ones are missing.
Preflight Request Configuration
Backend developers configuring CORS on their APIs can use the tester to verify their server's CORS setup. Test different origins, HTTP methods, and custom header combinations to ensure the server responds with the correct Access-Control-* headers before deploying to production.
Third-Party API Compatibility Check
Before integrating a third-party API into your web application, use the CORS Preflight Tester to verify the API supports cross-origin requests from your domain. Check whether the API allows your HTTP methods, custom headers, and whether credentials (cookies) can be included in requests.
Microservices CORS Policy Audit
Organizations with multiple microservices need consistent CORS policies across all endpoints. Use the CORS Preflight Tester to audit each service endpoint, ensuring they all follow the same CORS configuration. The tool's pass/fail analysis makes it easy to spot misconfigured services.
SaaS Platform Configuration
SaaS platforms that offer embeddable widgets, JavaScript SDKs, or iframe integrations rely on proper CORS configuration. Use the CORS Preflight Tester to verify CORS headers for customer domains, custom subdomains, and multiple deployment environments.
CORS Error Troubleshooting
When users report CORS-related errors in production, the CORS Preflight Tester helps quickly determine whether the issue is a server configuration problem, a browser restriction, or a client-side header mismatch. The detailed header analysis pinpoints exactly which CORS check is failing.
Understanding CORS Preflight Requests
What is a CORS Preflight Request?
A CORS preflight request is an HTTP OPTIONS request that a browser automatically sends before making certain cross-origin requests. It asks the server for permission to send the actual request by checking which origins, methods, and headers are allowed. The preflight is triggered when a request uses a non-simple method (anything other than GET, HEAD, or POST with standard content types), includes custom headers, or uses credentials (cookies or authorization headers).
How the CORS Preflight Process Works
- Browser checks if preflight is needed:If the request is “non-simple” (different HTTP method, custom headers, or credentials), the browser sends a preflight request before the actual request.
- OPTIONS request is sent: The browser sends an HTTP OPTIONS request to the target URL with three special headers:
Origin(the requesting origin),Access-Control-Request-Method(the HTTP method intended), andAccess-Control-Request-Headers(any custom headers intended). - Server responds with CORS policy: The server should respond with the relevant
Access-Control-*headers indicating its CORS policy. The browser checks these headers against the actual request's properties. - Browser decides:If the server's response allows the request (matching origin, method, and headers), the browser proceeds with the actual request. If not, the browser blocks the request and throws a CORS error in the console.
Understanding CORS Headers
- Access-Control-Allow-Origin: Specifies which origins are permitted. Can be a specific origin (e.g.,
https://my-app.com) or*(any origin, but not with credentials). - Access-Control-Allow-Methods: Lists the HTTP methods allowed for cross-origin requests (e.g.,
GET, POST, PUT, DELETE). - Access-Control-Allow-Headers: Lists the custom headers that can be included in cross-origin requests (e.g.,
Content-Type, Authorization). - Access-Control-Allow-Credentials: When set to
true, allows cookies, authorization headers, and TLS client certificates to be included in cross-origin requests. - Access-Control-Max-Age: Indicates how long (in seconds) the preflight response can be cached by the browser, reducing the number of preflight requests.
- Access-Control-Expose-Headers: Controls which response headers client JavaScript code is allowed to access.
Important Considerations for CORS Testing
Browser-based CORS testing has inherent limitations: a web page cannot send a bare OPTIONS preflight, cannot choose the Origin header (the browser always sends the page's own origin), and cannot read the Access-Control-* headers of a preflight. When a server does not allow the origin, the browser blocks the response entirely. The live check therefore tells you whether a real request from this site gets through; for any other origin or method, and to see the exact preflight headers, run the generated curl command and paste its output back into the tool.
Related Tools
cURL Command Generator
Build cURL commands visually with our interactive cURL command generator. Select HTTP method (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS), enter URL, add custom headers, set request body in JSON/form/raw format, configure authentication (Basic, Bearer, Digest), and toggle advanced options.
CORS Header Validator
Paste CORS response headers and validate them against the CORS specification. Checks Access-Control-Allow-Origin, Allow-Methods, Allow-Headers, Allow-Credentials, Max-Age, Expose-Headers, and Vary with severity-based pass/fail analysis. Optionally verify against expected origin, method, and custom headers - free.
Cache-Control Header Analyzer
Paste any Cache-Control header value and get a detailed analysis of every directive (max-age, public, private, no-cache, no-store, stale-while-revalidate, immutable, and more). Understand caching behavior, revalidation rules, and CDN implications with optimization recommendations - free online Cache-Control header.
Vary Header Checker
Check the Vary HTTP header to understand caching behavior. Enter any Vary header value and see detailed analysis of how each header affects cache efficiency, with cache efficiency, performance, and security ratings. Detects Vary: *, missing Vary: Origin with CORS, User-Agent cache fragmentation, Cookie header issues.
IP to Binary/Hex Converter
Convert any IPv4 address to dotted-decimal, hexadecimal, packed hex, binary, packed binary (32-bit), decimal integer, and IPv6-mapped formats instantly. Smart input detection supports dotted-decimal, decimal integer, packed hex, and packed binary input with real-time conversion, IP class detection, and special.
Wildcard Mask Calculator
Convert subnet masks to wildcard masks (inverse masks) used in Cisco ACLs and routing protocols. Enter any dotted-decimal subnet mask or wildcard mask for instant bidirectional conversion with binary representation, CIDR notation, host counts, and subnet class analysis - free online Wildcard Mask Calculator.
HSTS Preload Checker
Check if a domain is in the HSTS preload list, using Firefox's copy of Chromium's list (the list Chrome, Edge, Safari and Firefox build in). Shows Preloaded or Not Preloaded status, includeSubDomains coverage and the matching preload entry with detailed explanations - free online HSTS preload checker.
X-Frame-Options Checker
Check if a website sets the X-Frame-Options header for clickjacking protection. Enter a URL for a live HEAD check (for sites that allow cross-origin requests and expose the header; otherwise get a curl command), or paste a value (DENY, SAMEORIGIN, ALLOW-FROM) for analysis and recommendations.
Frequently Asked Questions About CORS Preflight Testing
A CORS preflight request is an HTTP OPTIONS request that browsers automatically send before making "non-simple" cross-origin requests. It asks the target server for permission by checking which origins, HTTP methods, and custom headers are allowed. Preflight requests are triggered when the request uses a non-simple method (PUT, DELETE, PATCH, etc.), includes custom headers (like Authorization or Content-Type: application/json), or uses credentials (cookies).
Enter a target URL, select an HTTP method, optionally specify an origin and custom headers, then click "Run Live CORS Check". Your browser sends a real GET (or HEAD) with those headers from this site and reports whether CORS - including the preflight, when one is needed - let it through. The tool also builds the exact OPTIONS preflight as a curl command for any origin and method; paste its output back to have all 6 Access-Control-* headers analysed.
When you paste the output of the generated curl command, the CORS Preflight Tester checks 6 key Access-Control-* response headers: Allow-Origin (origin matching), Allow-Methods (HTTP method validation), Allow-Headers (custom header permissions), Allow-Credentials (cookie/auth support), Max-Age (preflight caching duration), and Expose-Headers (client-accessible headers). Each check is shown with a pass/fail indicator and a detailed description of the result.
A CORS error occurs when the target server does not allow cross-origin requests from your origin. The browser's security policy blocks the response and throws a TypeError, without telling the page why. The tool then checks whether the server is reachable at all and whether a plain request (without your custom headers) would pass, to narrow down the cause. To see exactly which CORS headers the server returns, run the generated curl command and paste the output into the analyser.
Simple requests use standard methods (GET, HEAD, POST with Content-Type: form-urlencoded, multipart/form-data, or text/plain) and no custom headers - they bypass the preflight and go directly to the server. Non-simple requests (PUT, DELETE, PATCH, custom headers like Authorization, or Content-Type: application/json) trigger a preflight OPTIONS request first. Our tool lets you test both scenarios.
Browsers cannot send a preflight on its own: if the preflight passes, the real request follows immediately, and a real PUT, PATCH, DELETE or POST could change or delete data on the server. The live check therefore tests your origin and custom headers with a GET, and the generated curl command sends only the OPTIONS preflight for the method you picked, so you can see whether the server allows it without side effects.
Partly. You can add an Authorization header in the Custom Headers section, but browsers never let pages set a Cookie header, and the live check sends no cookies. When you analyse the curl output, the Access-Control-Allow-Credentials check tells you if the server allows credentials in cross-origin requests. Note that when credentials are included, servers cannot use the wildcard (*) for Access-Control-Allow-Origin - they must specify an exact origin.
Yes! The CORS Preflight Tester is 100% free with no signup, no API key, and no usage limits. Test as many URLs as you need, as often as you need. All requests go directly from your browser to the target server - no proxy is involved. We do not store, log, or process any test data on our servers.