Learn CORSErrorsTesterFrameworksQuizSearch

CORS Tester

Check whether an API’s response headers permit your frontend to read a response. See the CORS decision separately from the API’s HTTP status.

The remote probe runs through Beeceptor’s server. It simulates an origin and credentials mode; it cannot use your browser’s API session cookies or reach your localhost.

Use a public endpoint you are authorized to test. POST, PUT, PATCH, and DELETE may change data on that endpoint.

Scheme, host, and optional port. No path or query. Use null only to simulate an opaque origin.

This checks permission for credentialed access. It does not send your browser’s cookies, generate an Authorization header, or test cookie SameSite rules.

Describe the headers in the actual request. Authorization triggers preflight and must be explicitly allowed. The browser sets Origin and preflight headers itself.

The current remote service cannot faithfully serialize a JSON body. For requests with a body, capture the response in DevTools and analyze its headers locally.

The remote probe forwards your URL, method, headers, and body through tools.beeceptor.com to the API. Use test data and dummy tokens. Read about the data path.

Checklist for a readable CORS response

  1. Check whether the actual method and request headers require preflight. Credentials alone do not.
  2. If preflight is required, OPTIONS must return a 2xx status, origin permission, and any required method/header permissions.
  3. The actual response needs its own Access-Control-Allow-Origin, including on 401, 404, or 500 responses you intend to expose.
  4. With credentials mode include, return the exact origin and Access-Control-Allow-Credentials: true.
  5. Use Access-Control-Allow-Headers for request headers. Use Access-Control-Expose-Headers for extra response headers JavaScript needs to read.
  6. Access-Control-Max-Age can cache preflight permission. It is optional and browsers limit its effective duration.

What can this test prove?

A server probe can inspect response headers for a simulated origin. Local analysis can evaluate headers you already captured. The current remote service probes OPTIONS even for simple requests and may stop before capturing the actual response. An incomplete capture is not evidence that a browser would block a simple request. Neither mode proves that your browser can connect or that its cookies will be sent. An HTTP success alone does not prove CORS permission.

For the complete rules, see the Fetch Standard. Start with our request and preflight guide for a simpler explanation.