CORS Tester & Policy Analyzer
Test CORS in your browser or simulate a preflight with any Origin
Request
Simulated with a server request; browsers enforce the result. CodingTool servers send a preflight, plus GET or HEAD for those methods, without cookies, header values or a body, and return only response headers. Nothing is stored.
Sent as the Origin header. Use null to test sandboxed or file pages.
One per line. Only header names reach the server; values stay in your browser.
Simple request: browsers send it without a preflight.
Checks the rules for requests with cookies or HTTP authentication. None are sent.
Sends one extra preflight with the unrelated origin https://cors-probe.example.
Results
Response headers
Response headers appear here after a test.
Related Tools
What does the CORS tester check?
It shows whether a browser would let a web page on one origin read a response from another, and why. Policy Simulation evaluates Access-Control-Allow-Origin, -Credentials, -Methods, -Headers, -Expose-Headers and -Max-Age plus Vary: Origin, and reports each check as Pass, Warning, Fail or Info with the header value behind it.
Browser Test or Policy Simulation?
Browser Test sends a real fetch from your browser, so the result is actual browser enforcement, but the Origin is always CodingTool.dev and a blocked request only reports a generic error. Policy Simulation asks CodingTool servers to send the preflight with any Origin you choose and analyzes the response headers. It is a simulation: browsers enforce the final result.
When does a browser send a preflight?
Requests that use a method other than GET, HEAD or POST, a header outside the CORS-safelisted set, or a Content-Type other than text/plain, multipart/form-data or application/x-www-form-urlencoded are preflighted with OPTIONS. The preflight must answer with a 2xx status and must not redirect.
Credentials and wildcards
With credentials, Access-Control-Allow-Origin must name the exact origin and Access-Control-Allow-Credentials must be true. A * in Allow-Origin, Allow-Methods, Allow-Headers or Expose-Headers is treated literally for credentialed requests, and Allow-Headers: * never covers Authorization. A permissive header is not automatically a vulnerability; the tool reports what browsers accept.
Network use and privacy
Browser Test traffic goes only from your browser to the target. Policy Simulation sends the URL, origin, method and header names, never header values, cookies or bodies, to CodingTool servers. They block private, local and cloud metadata addresses, re-check the address on every connection, do not follow redirects, stop after 8 seconds, are rate limited, and store nothing.
