CORS Header Generator

Stop Guessing CORS Headers

Generating the correct Access-Control-Allow-Origin headers is one of the most frustrating aspects of modern web development. Whether you are building a decoupled frontend architecture, setting up microservices, or creating a public API, misconfiguring CORS will instantly break your application in the browser. Before deploying your new configuration, you should verify it using our CORS Tester or analyze your existing server responses with the HTTP Header Analyzer.

The core issue is that every web server and framework handles CORS slightly differently. A single typo in an Nginx add_header directive or a missed OPTIONS preflight handler in Express.js leads to the dreaded "Access to XMLHttpRequest has been blocked by CORS policy" error. This CORS Header Generator provides a visual interface to select your origins, methods, and credentials, instantly translating them into production-ready configuration code for Nginx, Apache, Express, and raw HTTP headers.

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type

Production CORS Examples

Here is how CORS headers are correctly applied in the most common web servers and frameworks.

1. Nginx CORS Configuration

In Nginx, CORS headers are typically added within a location block. It is critical to handle the OPTIONS preflight request by returning a 204 No Content status immediately.

location /api/ {
    if ($request_method = 'OPTIONS') {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain; charset=utf-8';
        add_header 'Content-Length' 0;
        return 204;
    }
    
    add_header 'Access-Control-Allow-Origin' '*' always;
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
    add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
}

2. Express.js (Node.js) Middleware

For Node.js backends, installing the standard cors package is the most robust solution. Here is how to configure it to allow a specific frontend origin while supporting credentials.

const express = require('express');
const cors = require('cors');
const app = express();

const corsOptions = {
  origin: 'https://my-frontend.example.com',
  methods: 'GET,POST,PUT,DELETE',
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
  optionsSuccessStatus: 204
};

app.use(cors(corsOptions));

app.get('/api/data', (req, res) => {
  res.json({ message: 'CORS is configured correctly!' });
});

3. Apache (.htaccess)

If you are running an Apache server, you can configure CORS directly in your .htaccess file using the Header directive. Ensure that the mod_headers module is enabled.

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
    Header set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
    Header set Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
</IfModule>

Troubleshooting CORS Preflight Failures

If your CORS headers are seemingly correct but requests still fail, the issue is almost certainly related to the preflight request. Browsers send an automatic HTTP OPTIONS request before sending requests that use custom headers (like Authorization) or methods other than GET/POST.

To resolve preflight failures:

• Ensure your server actively routes and responds to the OPTIONS method.
• Verify the preflight response returns a successful HTTP status code (typically 204 or 200).
• Check that the preflight response includes the required Access-Control-Allow-Methods and Access-Control-Allow-Headers.
• If using credentials, ensure Access-Control-Allow-Origin is set to the exact requesting domain, not a wildcard (*).