CORS Preflight & Access-Control Header ConfiguratorRFC 6454 / W3C Fetch Spec
Simulate browser CORS preflight OPTIONS requests and generate exact Access-Control-Allow-Origin headers for Nginx, Express, FastAPI, and Go.
Client Request Simulation
Browser EnvironmentTransmits cookies, authorization headers, and TLS certificates cross-origin.
Server CORS Policy Configurator
API Gateway / ServerAllow CredentialsAllow cookies & auth
CORS Simulation Passed: Browser Allows Request
Preflight OPTIONS request generated. Evaluated against server Access-Control rules.
Preflight Trigger Status:⚠️ Preflight (OPTIONS) Triggered
- HTTP Method 'PUT' is not a CORS-safelisted method (only GET, HEAD, POST are safe)
- Content-Type 'application/json' is not CORS-safelisted (triggers preflight)
- Non-safelisted request headers present: Authorization, X-Client-Version
CORS Security Evaluation Checklist
Origin AuthorizationValid
Origin 'https://dashboard.example.com' is allowed by the configured server policy.
HTTP Method PermissionValid
HTTP Method 'PUT' is allowed by Access-Control-Allow-Methods.
Request Headers AuthorizationValid
All client request headers are accepted by Access-Control-Allow-Headers.
Credentials SupportValid
Access-Control-Allow-Credentials: true matches client credentials: 'include'.
Vary: Origin Caching HeaderValid
'Vary: Origin' is configured to prevent CDN/reverse-proxy cache poisoning.
Preflight HTTP Wire Exchange
→ Browser Client Preflight Headers
OPTIONS /api/resource HTTP/1.1
Host:api.example.com
Origin:https://dashboard.example.com
Access-Control-Request-Method:PUT
Access-Control-Request-Headers:content-type, authorization, x-client-version
← Expected Server Response Headers
HTTP/1.1 204 No Content
Access-Control-Allow-Origin:https://dashboard.example.com
Access-Control-Allow-Methods:GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers:Authorization, Content-Type, X-Requested-With, X-Client-Version
Access-Control-Max-Age:7200
Access-Control-Allow-Credentials:true
Access-Control-Expose-Headers:Content-Length, X-Request-Id
Vary:Origin