CORS response header analyzer

Check whether a cross-origin request is allowed using its origin, method and response headers.

Simulates browser decisions without sending preflight requests. CORS does not replace authentication.

HTTP response headers or Access-Control-* lines

Input limit: 64 KiB.

Request scenario (optional)

Empty fields use a GET request.

Request Origin (optional) Method (optional) Request Headers (optional, one per line or comma-separated) Send credentials (Cookie, HTTP authentication, or client certificate) Private Network Access (target is a private network)

Structured CORS response header table / Complete diagnostic report

Header	Value	Analysis	Notes
Waiting

CORS guide

CORS boundary

CORS controls whether browser scripts can read a cross-origin response. It does not replace server-side authentication, authorization, CSRF protection, or data classification.

Preflight triggers

Non-simple methods, non-CORS-safelisted request headers, POST application/json, and PNA contexts commonly involve browser CORS-preflight cache behavior.

Credentials and wildcard origins

With credentials, Access-Control-Allow-Origin cannot be *. Access-Control-Allow-Credentials is effective only when the value is exactly true.

PNA / LNA note

Access-Control-Allow-Private-Network: true remains useful as a PNA compatibility diagnostic. Chrome's current public direction is a Local Network Access permission prompt replacing the paused PNA preflight effort. Confirm behavior in the target browser, version, enterprise policy, and experiment state.

Server-side reminders

Dynamic or reflected Origin handling must start with a server allowlist and use Vary: Origin for shared cache isolation. Do not reflect arbitrary Origin values.