CORS Header Validator
Validate CORS response headers against the CORS specification with our free CORS Header Validator. Paste any Access-Control-* headers and instantly check them against 7 specification rules including origin matching, method validation, header permissions, credential compliance, and more. Optionally provide an expected origin, HTTP method, or custom headers for detailed matching analysis. Results show pass/fail for each check with severity levels (error, warning, info) and clear explanations. No signup required.
Quick Test Presets
Why Use Our CORS Header Validator?
CORS Specification Compliance Check
The CORS Header Validator checks each header against the official CORS specification. It validates Access-Control-Allow-Origin syntax and origin matching, checks that Allow-Methods contains valid HTTP methods, verifies that Allow-Headers follows proper formatting, and confirms Allow-Credentials is exactly "true". Every check references the spec with clear pass/fail results.
7-Point Header Validation Suite
Paste your CORS response headers and the validator runs 7 specification checks: origin validation, method verification, header permission audit, credential compliance, max-age parsing, expose-headers inspection, and Vary header analysis for dynamic origin caching. Each check includes severity levels (error, warning, info) so you can prioritize fixes.
Cross-Header Conflict Detection
The validator automatically detects conflicting CORS configurations that violate the specification. It catches critical issues like using a wildcard Allow-Origin with Allow-Credentials: true, which the spec explicitly forbids. It also warns about overly permissive wildcard usage, missing Vary: Origin headers, and invalid max-age values.
Free & No Signup Required
Validate CORS headers on unlimited configurations with no signup, no API key, and no usage limits. All validation happens entirely in your browser - the header text never leaves your device. We do not store, log, or process any data on our servers. Completely free, forever.
Common Use Cases for CORS Header Validation
Backend CORS Configuration Validation
Backend developers configuring CORS on their APIs can use the CORS Header Validator to verify their server response headers before deploying. Paste the Access-Control-* headers from your server configuration and instantly see if they comply with the CORS specification. The validator catches common mistakes like missing headers, invalid values, and conflicting settings.
Preflight Response Header Analysis
When debugging CORS preflight failures, developers can copy the response headers from browser DevTools and paste them into the CORS Header Validator. The validator parses the headers and runs all specification checks, making it easy to see exactly which CORS header is misconfigured and why the browser is blocking the request.
Third-Party API CORS Audit
Before integrating a third-party API, paste its CORS headers into the validator to check if the API follows CORS best practices. The validator will flag overly permissive wildcard origins, missing Vary headers, and other configuration issues that could affect your application's security or performance.
Microservices CORS Policy Review
Engineering teams managing multiple microservices can use the CORS Header Validator to audit CORS policies across their service mesh. Paste headers from each service endpoint and ensure consistent CORS configuration. The validator's detailed pass/fail analysis makes it easy to spot services with misconfigured or missing CORS headers.
SaaS Embed Configuration Testing
SaaS platforms offering embeddable widgets or JavaScript SDKs rely on correct CORS headers. Use the CORS Header Validator to verify that your embed endpoints return the correct Access-Control-Allow-Origin for customer domains, and that the Allow-Credentials header is properly configured when using authentication.
CORS Error Troubleshooting
When users report CORS errors in production, support engineers can take the server's response headers and validate them with the CORS Header Validator. The tool pinpoints exactly which specification rule is being violated - whether it's a missing header, a mismatched origin, or a forbidden wildcard-with-credentials combination.
Understanding CORS Header Validation
What is CORS Header Validation?
CORS header validation is the process of checking that a server's CORS response headers comply with the Cross-Origin Resource Sharing specification (W3C Recommendation). When a browser makes a cross-origin request, it checks the server's Access-Control-* response headers against what the request needs. If the headers are missing, malformed, or contain conflicting values, the browser blocks the request and throws a CORS error. Validation ensures the headers are syntactically correct, mutually consistent, and aligned with the specification requirements before they reach production.
How the CORS Header Validator Works
- Paste headers: Copy CORS response headers from your server configuration, browser DevTools Network tab, or API documentation and paste them into the validator as raw header text (e.g.,
Access-Control-Allow-Origin: https://example.com). - Configure expected values (optional): Optionally provide an expected origin, HTTP method, or custom headers. This enables matching validation - the validator will check if the server allows the specific configuration your application needs.
- Specification analysis: The validator parses all headers, then runs each one through a series of specification checks: does the origin match? Are the methods valid? Are credentials properly configured? Is the max-age a valid number?
- Results with severity: Each check returns a pass/fail result with a severity level: error (spec violation, must fix), warning (best practice, should review), or info (informational, no action needed). The overall verdict shows pass, warning, or fail status.
CORS Headers Checked by the Validator
- Access-Control-Allow-Origin: Validates that the origin is a valid URI,
*, ornull. Checks for wildcard usage with credentials (forbidden by spec). Optionally matches against an expected origin if provided. - Access-Control-Allow-Methods: Verifies that each method is a valid HTTP method. Optionally checks that an expected method is in the list. Warns about wildcard usage (not supported in all browsers).
- Access-Control-Allow-Headers: Validates header names and optionally checks expected headers are in the list. Flags simple headers (Accept, Content-Type) that don't need to be listed.
- Access-Control-Allow-Credentials: Ensures value is exactly
true. Cross-checks with Allow-Origin - flags wildcard + credentials conflict. - Access-Control-Max-Age: Validates that value is a non-negative integer. Warns if value exceeds browser-specific caps (Chrome: 7200s, Firefox: 86400s).
- Access-Control-Expose-Headers: Lists headers accessible to client JavaScript. Flags when simple headers like Cache-Control are included.
- Vary: Checks if
Vary: Originis present when using dynamic (non-wildcard) origins - critical for proper CDN caching.
Privacy & Security in CORS Validation
The CORS Header Validator processes all data entirely in your browser. The header text you paste, the expected origin you enter, and the validation results never leave your device. No data is uploaded, stored, or transmitted to any server. This means you can safely validate headers from production APIs, internal services, or customer environments without any data privacy concerns. Because everything runs client-side, there are also no usage limits, no API keys needed, and the tool works even when you are offline after the initial page load.
Related Tools
DMARC Record Checker
Check DMARC records for any domain via Cloudflare DNS-over-HTTPS. Validate email authentication policy (none/quarantine/reject), analyse alignment settings (adkim, aspf), and extract reporting addresses (rua, ruf) - free online DMARC record checker.
DNS Leak Test
Check if DNS queries and WebRTC are leaking your real IP outside your VPN tunnel. Detects local IPs via WebRTC STUN requests, checks public IP and geolocation via free APIs, and identifies DNS resolvers - free online DNS leak test.
DNS Record Comparator
Compare DNS records across Cloudflare, Google, and Quad9 nameservers automatically. Detects differences in A, MX, NS, CNAME, TXT, AAAA, and SOA records with severity indicators - free online DNS comparison tool.
Reverse DNS Lookup
Look up PTR records for any IPv4 or IPv6 address via Cloudflare DNS-over-HTTPS. Instantly find the hostname behind any IP address with DNSSEC validation status and query time - free online reverse DNS lookup tool.
Frequently Asked Questions About CORS Header Validation
CORS header validation is the process of checking whether a server's Access-Control-* response headers comply with the W3C CORS specification. The validator checks each header for proper syntax, valid values, and mutual consistency - for example, ensuring that Access-Control-Allow-Origin is not set to "*" when Access-Control-Allow-Credentials is "true", which the specification explicitly forbids.
A CORS preflight tester sends an actual HTTP OPTIONS request to a server and shows the response headers. The CORS Header Validator works offline - you paste existing headers from any source (server config files, browser DevTools, API documentation) and it validates them against the specification. The header validator is useful when you want to check headers before deployment, audit configuration files, or analyze headers that a preflight tester cannot reach due to network restrictions.
The CORS Header Validator checks 7 aspects of your CORS configuration: Access-Control-Allow-Origin (syntax and origin matching), Access-Control-Allow-Methods (HTTP method validity), Access-Control-Allow-Headers (custom header permissions), Access-Control-Allow-Credentials (boolean value and wildcard conflict detection), Access-Control-Max-Age (numeric validation and browser cap warnings), Access-Control-Expose-Headers (client-accessible headers), and Vary (Origin presence for dynamic origins). Each check has a severity level (error, warning, info) with clear explanations.
The CORS specification (Section 6.1) explicitly states that if Access-Control-Allow-Credentials is "true", then Access-Control-Allow-Origin cannot be "*". This is a security measure - it prevents any arbitrary website from making credentialed requests to your server. When credentials are involved, the server must specify an exact origin so the browser can enforce same-origin security for sensitive requests.
Yes. Open your browser's Developer Tools (F12), go to the Network tab, find the request you want to investigate, and look at the Response Headers section. Copy all the Access-Control-* headers you see (and the Vary header if present), paste them into the CORS Header Validator, and run the validation. You can also enter the expected origin, method, and custom headers for detailed matching analysis.
When Access-Control-Allow-Origin is set to a specific (non-wildcard) origin, the server should include a Vary: Origin response header. This tells caches (like CDNs and browser caches) that the response varies based on the Origin request header. Without it, a cached response intended for one origin could be served to a different origin, causing CORS errors or worse - serving private data to the wrong client. The validator warns when Vary: Origin is missing for dynamic origins.
Yes! The CORS Header Validator is 100% free with no signup, no API key, and no usage limits. Validate as many header configurations as you need, as often as you need. All validation happens entirely in your browser - the header text never leaves your device. We do not store, log, or process any data on our servers.
The CORS Header Validator covers the 7 most important CORS-related headers: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Allow-Credentials, Access-Control-Max-Age, Access-Control-Expose-Headers, and Vary. It also recognizes other response headers but focuses validation on these core CORS headers. If a header is not recognized by the validator, it will still be displayed in the parsed headers list for reference.