CORS Preflight Tester
Test CORS preflight requests on any URL with our free CORS Preflight Tester. Send OPTIONS requests with custom origins, HTTP methods, and headers to see exactly which Access-Control-* response headers the server returns. The tool analyzes 6 CORS headers and provides a pass/fail verdict for each check, helping you diagnose CORS configuration issues quickly. Enable proxy mode to bypass browser restrictions and see the server's raw response headers. No signup required.
Quick Test Presets
Why Use Our CORS Preflight Tester?
Real CORS Preflight Request Testing
Send actual OPTIONS requests to any URL with custom origin, method, and headers. The CORS Preflight Tester uses the browser's fetch API to simulate real preflight requests - just like a browser would send before making a cross-origin request. Results include the full response headers from the server, showing exactly what CORS policy is in place.
Comprehensive CORS Header Analysis
The tool automatically analyzes 6 key Access-Control-* response headers: Allow-Origin (checks origin matching), Allow-Methods (validates the HTTP method), Allow-Headers (verifies custom headers), Allow-Credentials (checks cookie/auth support), Max-Age (preflight caching duration), and Expose-Headers (client-readable headers). Each check shows pass/fail with detailed explanations.
Proxy Mode for Cross-Origin Testing
Toggle the CORS proxy option to bypass browser same-origin restrictions. When enabled, the tool routes the OPTIONS request through a public CORS proxy, allowing you to see the server's actual CORS response headers even when the server does not allow your origin. This is invaluable for debugging CORS configuration issues.
Free & No Signup Required
Test CORS preflight requests on unlimited URLs with no signup, no API key, and no usage limits. All requests go directly from your browser to the target server (or through a free public proxy). We do not store, log, or process any test data on our servers. Completely free, forever.
Common Use Cases for CORS Preflight Testing
API Integration Debugging
Frontend developers testing API integrations use the CORS Preflight Tester to diagnose CORS errors. When a browser console shows "CORS policy: No 'Access-Control-Allow-Origin' header", use the tester to send a preflight request and see exactly which CORS headers the server returns - and which ones are missing.
Preflight Request Configuration
Backend developers configuring CORS on their APIs can use the tester to verify their server's CORS setup. Test different origins, HTTP methods, and custom header combinations to ensure the server responds with the correct Access-Control-* headers before deploying to production.
Third-Party API Compatibility Check
Before integrating a third-party API into your web application, use the CORS Preflight Tester to verify the API supports cross-origin requests from your domain. Check whether the API allows your HTTP methods, custom headers, and whether credentials (cookies) can be included in requests.
Microservices CORS Policy Audit
Organizations with multiple microservices need consistent CORS policies across all endpoints. Use the CORS Preflight Tester to audit each service endpoint, ensuring they all follow the same CORS configuration. The tool's pass/fail analysis makes it easy to spot misconfigured services.
SaaS Platform Configuration
SaaS platforms that offer embeddable widgets, JavaScript SDKs, or iframe integrations rely on proper CORS configuration. Use the CORS Preflight Tester to verify CORS headers for customer domains, custom subdomains, and multiple deployment environments.
CORS Error Troubleshooting
When users report CORS-related errors in production, the CORS Preflight Tester helps quickly determine whether the issue is a server configuration problem, a browser restriction, or a client-side header mismatch. The detailed header analysis pinpoints exactly which CORS check is failing.
Understanding CORS Preflight Requests
What is a CORS Preflight Request?
A CORS preflight request is an HTTP OPTIONS request that a browser automatically sends before making certain cross-origin requests. It asks the server for permission to send the actual request by checking which origins, methods, and headers are allowed. The preflight is triggered when a request uses a non-simple method (anything other than GET, HEAD, or POST with standard content types), includes custom headers, or uses credentials (cookies or authorization headers).
How the CORS Preflight Process Works
- Browser checks if preflight is needed:If the request is “non-simple” (different HTTP method, custom headers, or credentials), the browser sends a preflight request before the actual request.
- OPTIONS request is sent: The browser sends an HTTP OPTIONS request to the target URL with three special headers:
Origin(the requesting origin),Access-Control-Request-Method(the HTTP method intended), andAccess-Control-Request-Headers(any custom headers intended). - Server responds with CORS policy: The server should respond with the relevant
Access-Control-*headers indicating its CORS policy. The browser checks these headers against the actual request's properties. - Browser decides:If the server's response allows the request (matching origin, method, and headers), the browser proceeds with the actual request. If not, the browser blocks the request and throws a CORS error in the console.
Understanding CORS Headers
- Access-Control-Allow-Origin: Specifies which origins are permitted. Can be a specific origin (e.g.,
https://my-app.com) or*(any origin, but not with credentials). - Access-Control-Allow-Methods: Lists the HTTP methods allowed for cross-origin requests (e.g.,
GET, POST, PUT, DELETE). - Access-Control-Allow-Headers: Lists the custom headers that can be included in cross-origin requests (e.g.,
Content-Type, Authorization). - Access-Control-Allow-Credentials: When set to
true, allows cookies, authorization headers, and TLS client certificates to be included in cross-origin requests. - Access-Control-Max-Age: Indicates how long (in seconds) the preflight response can be cached by the browser, reducing the number of preflight requests.
- Access-Control-Expose-Headers: Controls which response headers client JavaScript code is allowed to access.
Important Considerations for CORS Testing
Browser-based CORS testing has inherent limitations: when a server does not allow your origin, the browser blocks the response and JavaScript cannot read the CORS headers. Our tool addresses this by offering a proxy mode that routes the request through a public CORS proxy, allowing you to see the server's actual response headers regardless of the server's CORS policy. However, proxy mode introduces its own behavior - the proxy adds its own CORS headers. For the most accurate results, test both with and without the proxy. For production debugging, always verify CORS configuration using server-side tools like curl as well.
Related Tools
DMARC Record Checker
Check DMARC records for any domain via Cloudflare DNS-over-HTTPS. Validate email authentication policy (none/quarantine/reject), analyse alignment settings (adkim, aspf), and extract reporting addresses (rua, ruf) - free online DMARC record checker.
DNS Leak Test
Check if DNS queries and WebRTC are leaking your real IP outside your VPN tunnel. Detects local IPs via WebRTC STUN requests, checks public IP and geolocation via free APIs, and identifies DNS resolvers - free online DNS leak test.
DNS Record Comparator
Compare DNS records across Cloudflare, Google, and Quad9 nameservers automatically. Detects differences in A, MX, NS, CNAME, TXT, AAAA, and SOA records with severity indicators - free online DNS comparison tool.
Reverse DNS Lookup
Look up PTR records for any IPv4 or IPv6 address via Cloudflare DNS-over-HTTPS. Instantly find the hostname behind any IP address with DNSSEC validation status and query time - free online reverse DNS lookup tool.
Frequently Asked Questions About CORS Preflight Testing
A CORS preflight request is an HTTP OPTIONS request that browsers automatically send before making "non-simple" cross-origin requests. It asks the target server for permission by checking which origins, HTTP methods, and custom headers are allowed. Preflight requests are triggered when the request uses a non-simple method (PUT, DELETE, PATCH, etc.), includes custom headers (like Authorization or Content-Type: application/json), or uses credentials (cookies).
Enter a target URL, select an HTTP method, optionally specify an origin and custom headers, then click "Send Preflight Request". The tool sends an OPTIONS request to the target server and analyzes the Access-Control-* response headers. It checks 6 CORS headers and shows pass/fail for each with detailed explanations. Enable proxy mode to bypass browser restrictions when testing servers that block your origin.
The CORS Preflight Tester checks 6 key Access-Control-* response headers: Allow-Origin (origin matching), Allow-Methods (HTTP method validation), Allow-Headers (custom header permissions), Allow-Credentials (cookie/auth support), Max-Age (preflight caching duration), and Expose-Headers (client-accessible headers). Each check is shown with a pass/fail indicator and a detailed description of the result.
A CORS error occurs when the target server does not allow cross-origin requests from your origin. The browser's security policy blocks the response and throws a TypeError. To see the server's actual response headers, enable the "Use CORS Proxy" toggle - this routes the request through a public proxy that bypasses browser restrictions, allowing you to see exactly which CORS headers the server returns.
Simple requests use standard methods (GET, HEAD, POST with Content-Type: form-urlencoded, multipart/form-data, or text/plain) and no custom headers - they bypass the preflight and go directly to the server. Non-simple requests (PUT, DELETE, PATCH, custom headers like Authorization, or Content-Type: application/json) trigger a preflight OPTIONS request first. Our tool lets you test both scenarios.
Use proxy mode when the target server does not allow your origin and you want to see the server's actual CORS response headers. Without proxy mode, direct OPTIONS requests work for same-origin targets and servers with permissive CORS. For the most accurate test results, try both modes - direct first (to simulate a real browser experience), then proxy mode (to see the full server response).
Yes. Include cookies or authentication by adding an Authorization header in the Custom Headers section. The tool's Access-Control-Allow-Credentials check will tell you if the server allows credentials in cross-origin requests. Note that when credentials are included, servers cannot use the wildcard (*) for Access-Control-Allow-Origin - they must specify an exact origin.
Yes! The CORS Preflight Tester is 100% free with no signup, no API key, and no usage limits. Test as many URLs as you need, as often as you need. All requests go directly from your browser to the target server (or through a free public proxy). We do not store, log, or process any test data on our servers.