CORS Checker

Cross-Origin Resource Sharing is a browser mechanism that allows requests from another domain. The server sends Access-Control-Allow-Origin. Without it, fetch/XHR requests to another domain are blocked.

The server didn’t return the required Access-Control header, or it doesn’t match the origin. Check the response in Network. CORS Checker simulates a request and displays the headers.

For “complex” requests (anything other than GET/POST with simple headers), the browser sends an OPTIONS request first. The server must respond with CORS headers. Preflight responses are cached.

Access-Control-Allow-Origin: * is only for public APIs without credentials. With credentials, a specific origin is required. * and credentials are incompatible.

CORS is a browser security feature. You can't “disable” it on the server — you can only allow the required origins. Don't use * for APIs with authentication.