Find Out Why CORS Is Blocking You
Diagnose why a request is blocked
GET, HEAD or POST with no custom headers and an ordinary Content-Type goes straight out. The server still has to return Access-Control-Allow-Origin or you will not be allowed to read the response.There is no proxy behind this page. The request leaves your machine with your origin (this site) and, if you ask for them, your cookies, exactly as it would from your own application. That is the point: a server-side tester tells you nothing about CORS, because CORS is a rule the browser enforces and a server ignores. It also means this can reach a local development server that a hosted tester never could.
What is CORS Tester?
Find out why a cross-origin request is being blocked, from the only place that can tell you: a browser. The request leaves your machine with your origin and, if you want, your cookies, exactly as it would from your own application, and the tool reports what came back and which headers your JavaScript is allowed to read. When it fails, it enumerates the handful of things the browser will never tell you directly, because a precise reason would itself leak information across origins. It also says up front whether your combination of method, headers and content type triggers a preflight, which is what most "CORS errors" actually are.
How do I use CORS Tester?
- Enter the URL and choose a method.
- Add a custom header or a content type if your real request uses one.
- Check whether the tool says a preflight will be triggered.
- Send the request and read the diagnosis and the readable headers.
When should I use CORS Tester?
Use this when a fetch works in your terminal but fails in the browser, which is nearly always a CORS problem rather than a server one. To turn a working curl command into code, use Curl to Code. To inspect a bearer token, use JWT Decoder.
Frequently asked questions
Why is there no proxy behind this?
Because a proxy would defeat the purpose. CORS is a rule your browser enforces; a server ignores it entirely. A server-side tester would report a cheerful 200 for a request your browser will refuse, which tells you nothing. The request here leaves your machine, with your origin, exactly as your own application would send it.
Why does the error message say so little?
Because the browser deliberately withholds the reason. If a page could learn precisely why a cross-origin request failed, that would itself leak information about the other origin. So the browser reports a generic failure and the useful thing a tool can do is enumerate what it actually means, which is what happens here.
What is a preflight?
For anything beyond a simple request, the browser first sends an OPTIONS request asking permission, and only sends the real one if the answer allows it. Any method other than GET, HEAD or POST triggers it, as does any custom header such as Authorization, or a Content-Type outside a short permitted list. Most reported CORS errors are an OPTIONS request the server never answered, often because the framework only routes the methods you declared and returns 404 or 405 for OPTIONS.
Why can I not see the header the server definitely sent?
Because only a handful of response headers are readable across origins by default. Anything else must be listed by the server in Access-Control-Expose-Headers. This is why a header plainly visible in curl is missing in the browser, and the tool shows exactly which ones it was allowed to read.
My request works with cookies in curl but not here.
Credentialed requests have an extra rule: the server must echo your exact origin rather than a wildcard, and must also send Access-Control-Allow-Credentials: true. A wildcard with cookies is rejected by every browser. The tool points this out when it sees that combination.
Can I test a localhost server?
Yes, and this is one of the few browser tools that can, precisely because there is no server in the middle. A hosted tester cannot reach your machine. Note that some browsers apply extra private-network restrictions when a public page requests a local address.
Why not a full API client instead?
Because a browser cannot honestly be one. Add an Authorization header and the preflight usually fails; request a localhost address and it may be blocked; use no-cors mode and the response is opaque, so even the status code is unreadable. Every serious API client solves this by leaving the browser, with a desktop app, an extension or a proxy. Diagnosing CORS is the part that genuinely belongs here.
Is my file uploaded anywhere?
No. Everything runs in your browser. Your files never leave your device, and there is no server component for this tool.
Tools that pair well with CORS Tester
- cURL to Code Converter curl → fetch / axios / python, free and in your browser.
- JWT Decoder inspect jwt payloads, free and in your browser.
- URL Encoder percent-encode text, free and in your browser.
- JSON Formatter format & validate json, free and in your browser.