Skip to content
🌐

CORS Header Generator

Developer

Generate Cross-Origin Resource Sharing (CORS) headers for your web server.

0
0

Raw, Nginx and Apache snippets use the first allowed origin. Framework snippets match the request origin against the allowlist. Merge Vary with any existing response values.

Scenario
Allowed Origins
https://example.com
Allowed Methods
Allowed Headers
Exposed Headers
X-RateLimit-RemainingX-RateLimit-Reset
Preflight Max Age (seconds)
CORS Headers Preview
Access-Control-Allow-Origin:https://example.com
Access-Control-Allow-Methods:GET, POST, PUT, DELETE, PATCH, OPTIONS
Access-Control-Allow-Headers:Content-Type, Authorization
Access-Control-Expose-Headers:X-RateLimit-Remaining, X-RateLimit-Reset
Access-Control-Max-Age:86400
Vary:Origin
Nginx Configuration
# Static origin configuration; use an allowlist map for multiple origins.
location / {
  add_header Access-Control-Allow-Origin "https://example.com" always;
  add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, PATCH, OPTIONS" always;
  add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
  add_header Access-Control-Expose-Headers "X-RateLimit-Remaining, X-RateLimit-Reset" always;
  add_header Access-Control-Max-Age "86400" always;
  add_header Vary "Origin" always;
  if ($request_method = OPTIONS) { return 204; }
}
Apache Configuration
# Requires mod_headers and mod_rewrite. Static first origin only.
Header always set Access-Control-Allow-Origin "https://example.com"
Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, PATCH, OPTIONS"
Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
Header always set Access-Control-Expose-Headers "X-RateLimit-Remaining, X-RateLimit-Reset"
Header always set Access-Control-Max-Age "86400"
Header always set Vary "Origin"
RewriteEngine On
RewriteCond %{REQUEST_METHOD} =OPTIONS
RewriteRule ^ - [R=204,L]
Express.js
const cors = require('cors');
app.use(cors({
  "origin": [
    "https://example.com"
  ],
  "methods": [
    "GET",
    "POST",
    "PUT",
    "DELETE",
    "PATCH",
    "OPTIONS"
  ],
  "allowedHeaders": [
    "Content-Type",
    "Authorization"
  ],
  "exposedHeaders": [
    "X-RateLimit-Remaining",
    "X-RateLimit-Reset"
  ],
  "credentials": false,
  "maxAge": 86400
}));
Next.js
import { NextResponse } from 'next/server';
const allowedOrigins = ["https://example.com"];
export function middleware(request) {
  const origin = request.headers.get('origin');
  const response = request.method === 'OPTIONS' ? new NextResponse(null, {status: 204}) : NextResponse.next();
  if (allowedOrigins.includes(origin)) {
    const headers = {
  "Access-Control-Allow-Origin": "https://example.com",
  "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
  "Access-Control-Allow-Headers": "Content-Type, Authorization",
  "Access-Control-Expose-Headers": "X-RateLimit-Remaining, X-RateLimit-Reset",
  "Access-Control-Max-Age": "86400",
  "Vary": "Origin"
};
    headers['Access-Control-Allow-Origin'] = origin;
    for (const [key,value] of Object.entries(headers)) response.headers.set(key,value);
  }
  return response;
}
export const config = {matcher: '/api/:path*'};
Django
# Install django-cors-headers; add corsheaders to INSTALLED_APPS
# and corsheaders.middleware.CorsMiddleware before CommonMiddleware.
CORS_ALLOW_ALL_ORIGINS = False
CORS_ALLOWED_ORIGINS = ["https://example.com"]
CORS_ALLOW_METHODS = ["GET","POST","PUT","DELETE","PATCH","OPTIONS"]
CORS_ALLOW_HEADERS = ["content-type","authorization"]
CORS_EXPOSE_HEADERS = ["X-RateLimit-Remaining","X-RateLimit-Reset"]
CORS_ALLOW_CREDENTIALS = False
CORS_PREFLIGHT_MAX_AGE = 86400
Flask
from flask_cors import CORS
CORS(app, origins=["https://example.com"], methods=["GET","POST","PUT","DELETE","PATCH","OPTIONS"], allow_headers=["Content-Type","Authorization"], expose_headers=["X-RateLimit-Remaining","X-RateLimit-Reset"], supports_credentials=False, max_age=86400)
💡 CORS Tips
  • Never use * for credentials requests
  • Preflight requests (OPTIONS) are cached with max-age
  • Test CORS with browser DevTools Network tab
  • For production, specify exact origins instead of wildcards

Setting Access-Control-Allow-Origin to a wildcard and also trying to allow credentialed requests at the same time looks like it should work but doesn't, browsers actually reject that specific combination outright, a well-known but easy-to-hit CORS gotcha that silently breaks an authenticated cross-origin request rather than throwing an obvious error explaining why. This tool generates a complete, consistent set of CORS headers, origin, methods, headers, and credentials together, avoiding invalid combinations like a wildcard origin paired with allowed credentials.

See more about the CORS Header Generator

Useful for generating CORS headers for an API that needs to allow credentialed requests without accidentally combining them with a wildcard origin, configuring exactly which methods and headers a cross-origin request is allowed to use, or debugging why a browser is silently blocking a cross-origin request despite headers that look correct at a glance.

Key features

  • Clean interface
  • Fast processing
  • No signup required
  • Works offline

Related Blog Posts

Quick answers for CORS Header Generator

Which server frameworks can this generate config for?
Beyond raw HTTP headers, it outputs ready-to-paste CORS code for Nginx, Apache, Express.js, Next.js, Django, and Flask, matching each framework's actual header-setting syntax.
What do the preset scenarios configure?
Nine starting points, including Public API (fully open), With Credentials, Restricted origins, Dynamic Origin, and framework-specific presets for WordPress, Next.js, Express, Django, and Flask, each pre-filling realistic allowed methods, headers, and origins for that case.
Does this tool test my server's actual CORS behavior?
No, it only generates the header configuration for you to add to your own server, it does not send requests to check what your server currently returns.