CORS Policy Builder

Generate CORS headers for Nginx, Apache, Cloudflare, Express, Node, and AWS. Pure client-side.

Comma-separated. Use * for wildcard.
  • Never use * for origins if you allow credentials
  • Use specific origins in production: https://yoursite.com
  • Wildcard * origins work only when credentials are disabled
  • Set a reasonable max-age to avoid excessive preflight requests

About this CORS Policy Builder

Cross-Origin Resource Sharing (CORS) is a browser security feature. Servers opt in to cross-origin reads via headers like Access-Control-Allow-Origin. Misconfigured CORS is a top reason front ends fail to call APIs.

This builder helps generate example header configs for common servers. Always understand the security impact of wildcards and credentialed requests.

How to use this tool

  1. Choose allowed origins, methods, and headers.
  2. Generate config snippets for your stack.
  3. Deploy and verify with browser devtools Network tab.

Common use cases

FAQ

Is Access-Control-Allow-Origin: * safe?

Fine for fully public read-only APIs; avoid with credentials and sensitive data.

Privacy

DevToolBox tools are designed to process data in your browser whenever possible. Read our Privacy Policy and About page for details on client-side processing and network lookups.

Related tools

API Tester ¡ Query Parser ¡ URL Encoder

Sponsored