CORS Policy Tester
Evaluate a supplied CORS response against an origin, method and credentials scenario.
Loading tool…
How to use CORS Policy Tester
Evaluate a supplied CORS response against an origin, method and credentials scenario. Exact-origin, wildcard, credential, non-safelisted method and requested-header rules are checked locally. Authorization headers require explicit allowance even under a header wildcard.
- Provide the input and select the documented mode or options.
- Run the tool and review its result and any limits reported below.
- Copy the text result or download a separate output file.
Good to know
- Enter only request header names that require preflight. Content-Type values and safelisted-value rules are not inferred.
- 10,000 response header characters; no live request. Redirects, status, browser-specific and private-network policy are not evaluated.
- Processing happens in this browser tab. Inputs and results are not automatically saved or uploaded.
Common questions
What does CORS Policy Tester process?
Exact-origin, wildcard, credential, non-safelisted method and requested-header rules are checked locally. Authorization headers require explicit allowance even under a header wildcard.
What happens to my original input?
The tool creates a separate result. Selected files and pasted data remain on this device; inspect the result before using it in another system.
Keep going with related tools
All developer →URL Parser
Inspect HTTP(S) URL components, normalized hostnames, and repeated query parameters without visiting a link.
DeveloperJSON Formatter
Format and indent valid JSON in your browser, with downloadable output and clear syntax errors.
DeveloperJSON Viewer
Inspect a JSON document as a safe path, type, and value tree without executing its contents.
DeveloperJSON Validator
Check JSON syntax locally and see its root type, value count, and nesting depth.
DeveloperJSON to CSV
Convert a JSON array of objects into a quoted CSV table with spreadsheet formula protection.
DeveloperJSON to XML
Convert JSON into escaped, typed XML while preserving arbitrary object keys and array ordering.