CORS Header Generator

Configure CORS once, get raw headers plus 4 server config snippets.

Allowed origin

Origin(s), comma-separated

Allowed methods

Allowed headers, comma-separated

Allow credentials

Max age (seconds)

Raw headers

Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type
Access-Control-Max-Age: 86400

Nginx

add_header 'Access-Control-Allow-Origin' 'https://example.com' always;
add_header 'Access-Control-Allow-Methods' 'GET, POST' always;
add_header 'Access-Control-Allow-Headers' 'Content-Type' always;
add_header 'Access-Control-Max-Age' '86400' always;

Apache

Header set Access-Control-Allow-Origin "https://example.com"
Header set Access-Control-Allow-Methods "GET, POST"
Header set Access-Control-Allow-Headers "Content-Type"
Header set Access-Control-Max-Age "86400"

Express

app.use((req, res, next) => {
  res.header("Access-Control-Allow-Origin", "https://example.com");
  res.header("Access-Control-Allow-Methods", "GET, POST");
  res.header("Access-Control-Allow-Headers", "Content-Type");
  res.header("Access-Control-Max-Age", "86400");
  next();
});

ASP.NET Core

services.AddCors(options =>
  options.AddPolicy("MyPolicy", policy =>
  {
    policy.WithOrigins("https://example.com");
    policy.WithMethods("GET", "POST");
    policy.WithHeaders("Content-Type");
    policy.SetPreflightMaxAge(TimeSpan.FromSeconds(86400));
  }));

What is this tool?

Cross-Origin Resource Sharing (CORS) headers tell browsers which origins, methods, and headers a server allows. This tool builds the raw Access-Control-* header values from your configuration, plus ready-to-paste snippets for Nginx, Apache, Express, and ASP.NET Core — and flags wildcard origin (*) combined with allow-credentials as an error, since browsers reject that combination outright per the CORS spec.

How to use it

Choose a wildcard or specific origin, and select allowed methods/headers.
Toggle allow-credentials and set a max-age if needed.
Copy the raw headers or a server-specific config snippet.

What is this tool?

How to use it

Related network & web security tools