CORS (Cross-Origin Resource Sharing) is a browser security mechanism that restricts how JavaScript code in one origin (domain) can make requests to a different origin. For example, code running on app.example.com cannot fetch data from api.other.com unless the API explicitly allows it via CORS headers.

What does 'Access-Control-Allow-Origin' mean?

This header in the server's response tells the browser which origins are allowed to read the response. A value of '*' allows any origin. A specific value like 'https://app.example.com' restricts access to that origin only.

What is a CORS preflight request?

For certain requests (non-GET/POST, or those with custom headers), the browser first sends an OPTIONS request to check whether the server allows the actual request. This is called a preflight. The server must respond with the appropriate allow headers for the actual request to proceed.

Why does my API work in Postman but not in the browser?

Postman does not enforce CORS because it is not a browser. CORS is a browser-only security policy. If your API works in Postman but fails in the browser, the server is not sending the correct CORS headers for your frontend's origin.

How do I fix a CORS error?

The fix must be on the server side. Add the appropriate Access-Control-Allow-Origin header to your API responses. If using Express.js, the 'cors' npm package handles this easily. For nginx, add the header in your server block. If you do not control the server, use a backend proxy to forward requests.

What causes a CORS error?

A CORS error occurs when a browser makes a request to a different origin (domain, protocol, or port) and the server's response doesn't include the correct Access-Control-Allow-Origin header. The browser blocks the response to protect users.

Can I fix a CORS error on the client side?

No. CORS is enforced by the browser and requires the server to set the correct headers. If you control the API, add the appropriate Access-Control-Allow-Origin header. If you don't control the API, use a server-side proxy instead.

CORS Tester — Test Cross-Origin Request Headers Free Online

Test CORS headers for any API endpoint. Debug Access-Control-Allow-Origin errors and verify cross-origin resource sharing configuration. Free, instant.

API Endpoint URL

HTTP Method

Request Origin

Try a public API:

CORS testing requires the target server to respond to cross-origin requests. If the direct fetch fails, the server is blocking the request from this origin. For private/internal APIs, test from your own origin or use a browser extension.

100% Private

No Upload

Instant

What is CORS Tester?

A CORS (Cross-Origin Resource Sharing) tester sends a preflight OPTIONS request to any API endpoint and checks the response headers for CORS policy configuration. It shows whether Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Allow-Credentials are correctly set. CORS misconfigurations are a common cause of browser API call failures.

How to Use CORS Tester

1Enter the API URL you want to test.
2Enter the origin you are testing from (e.g., https://yoursite.com).
3Select the HTTP method to test (GET, POST, etc.).
4Click Test CORS to send a preflight request.
5Review the CORS headers returned and check for policy violations.

Key Features

Sends OPTIONS preflight request
Displays all Access-Control-* response headers
Tests specific origins against the CORS policy
Checks allowed methods and headers
Clear pass/fail CORS evaluation

Benefits

Debug 'blocked by CORS policy' browser errors quickly
Verify API endpoints accept requests from your front-end origin
Test CORS configuration before deploying to production
Identify overly permissive CORS policies for security review

Why Use Irreva for CORS Tester?

Debug 'blocked by CORS policy' browser errors quickly

Verify API endpoints accept requests from your front-end origin

Test CORS configuration before deploying to production

Runs 100% in your browser — files never leave your device.

No account, no sign-up, no subscription — free forever.

Works on any device: desktop, tablet, or mobile.

Frequently Asked Questions

More Web Tools

Blacklist Checker Bulk Redirect Checker Disposable Email Checker DMARC Checker DMARC Generator DNS Lookup