CORS Header Builder

The CORS Header Builder is a free browser-based tool that helps you generate correct Access-Control-* HTTP response headers without memorizing the spec. Cross-Origin Resource Sharing (CORS) is the mechanism that lets browsers make requests across different domains safely. Misconfigured CORS headers are one of the most common sources of frustrating frontend errors — and one of the easiest to prevent with the right tooling.

This builder gives you a visual form to configure every CORS-related header: Access-Control-Allow-Origin (wildcard, specific origin list, or regex), Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age, and Access-Control-Allow-Credentials. As you toggle options the output updates in real time, so you can see exactly what your server needs to send. The tool also warns you about common mistakes such as using credentials: true with a wildcard origin — a combination that browsers silently reject.

Output is available in five formats: raw HTTP headers, Nginx add_header directives, Apache .htaccess rules, Express.js cors middleware options, and Next.js next.config.js headers. If you are setting up a Content Security Policy alongside your CORS headers, try the CSP Header Generator. For a deeper dive into all response headers your server sends, the HTTP Header Analyzer can parse and explain them. And if you are writing full Nginx server blocks, the Nginx Config Generator covers reverse proxy, SSL, and caching directives too.

A built-in preflight simulation shows the OPTIONS request a browser would send and the expected response, helping you verify your configuration before deploying. Four presets — Open API, Same-Site Only, Specific Origins, and CDN — let you start from a sensible baseline and customize from there.

All processing happens entirely in your browser. No data is transmitted to any server, making it safe to use with internal API URLs and production domains.

1. Choose an Origin Mode — wildcard (*), specific origins, or a regex pattern — from the dropdown.
2. If you selected specific origins, type each allowed origin (e.g. https://app.example.com) and press Enter or click + to add it to the list.
3. Toggle the HTTP methods your API supports by clicking the method buttons (GET, POST, PUT, etc.).
4. Select the allowed request headers from the common-headers grid and add any custom headers in the text input below.
5. Optionally enter exposed headers so the browser can read non-standard response headers, set a Max-Age for preflight caching, and toggle Credentials if your API uses cookies or auth headers.
6. Choose an output format — Raw Headers, Nginx, Apache, Express.js, or Next.js — and review the generated config.
7. Click Copy or press Ctrl+Shift+C to copy the output to your clipboard. Use Show Preflight Simulation to verify the OPTIONS request/response pair.