CORS Analyzer
Paste Access-Control-* response headers or a full HTTP response to review allowed origins, credentials, methods, request headers, exposed headers, preflight caching, Vary behavior, and clear configuration conflicts. Analysis runs entirely in your browser.
Inspect a pasted CORS origin or response header block and highlight origin, credential, method, header, max-age, and Vary combinations that may need correction or review.
How to analyze CORS headers
- Paste an origin value, CORS headers, or a full HTTP response header block.
- Run the analyzer and review Access-Control-Allow-Origin, credentials, methods, allowed headers, exposed headers, max-age, and Vary.
- Check errors and review notices such as wildcard origin with credentials or a specific origin without Vary: Origin.
What the analyzer checks
Repeated Access-Control-Allow-Origin, invalid origins, invalid credential values, wildcard origin with credentials, and malformed Access-Control-Max-Age are treated as errors.
Specific origins without Vary: Origin and wildcard methods, allowed headers, or exposed headers combined with credentials are review conditions in this implementation.
Privacy and limitations
CORS data is analyzed locally from pasted text and no cross-origin request is sent. The tool does not test a real browser preflight, server routing, credential cookies, redirects, proxy behavior, or whether a particular frontend request succeeds in production.
CORS Analyzer FAQ
Does it send a CORS request?
No. It analyzes pasted values only.
Is * with credentials allowed?
The analyzer flags Access-Control-Allow-Origin: * together with credentials=true as an error.
Why does it mention Vary: Origin?
A specific allowed origin without Vary: Origin can be problematic for shared caches, so it is marked for review.
Does it verify a real preflight?
No. It does not contact the server.
Are my headers uploaded?
No. Processing stays in the browser.