ToolCraft
HomeAI ToolsDeveloper ToolsUnit ConverterImage Tools
ToolCraft

© 2026 ToolCraft. All rights reserved.

Privacy PolicyTerms of Service
DMCA.com Protection Status
HomeSecurityCORS Config Generator

Security

Password GeneratorHash CheckerPassword Strength CheckerEncryption ToolSSL Certificate Decoderhtpasswd GeneratorCSP GeneratorCORS Config GeneratorTOTP / 2FA QR Generator

CORS Config Generator

Generate CORS configuration for Node.js, Nginx and Apache

Max Age (s):
Node.js / Express
app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', '*');
  res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
  res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
  res.header('Access-Control-Max-Age', '86400');
  if (req.method === 'OPTIONS') {
    return res.sendStatus(204);
  }
  next();
});
Nginx
location /api/ {
    add_header 'Access-Control-Allow-Origin' '*' always;
    add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE' always;
    add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization' always;
    add_header 'Access-Control-Max-Age' '86400' always;

    if ($request_method = 'OPTIONS') {
        return 204;
    }
}
Apache .htaccess
<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
    Header set Access-Control-Allow-Methods "GET, POST, PUT, DELETE"
    Header set Access-Control-Allow-Headers "Content-Type, Authorization"
    Header set Access-Control-Max-Age "86400"
</IfModule>

# Handle preflight requests
RewriteEngine On
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=204,L]

View all Security

View all
100% offline

CSP Generator

Generate Content Security Policy headers for your website

Security
100% offline

htpasswd Generator

Generate Apache htpasswd file entries for HTTP authentication

Security
100% offline

SSL Certificate Decoder

Decode and inspect SSL/TLS certificates

Security

What is the CORS Tester?

The CORS Tester checks Cross-Origin Resource Sharing headers for any URL. It sends a preflight OPTIONS request and analyzes the response headers to determine what origins, methods, and headers are allowed. Essential for debugging CORS issues in web applications, verifying API configurations, and understanding why cross-origin requests might be failing.

FAQ