CORS Header Checker
Review pasted CORS headers against an origin and exact method token. See duplicates and limits; this local tool does not predict the full browser outcome.
Review pasted CORS headers against an origin and exact method token. See duplicates and limits; this local tool does not predict the full browser outcome.
CORS Header Checker is a free HTTP & Security Header Tools utility that runs entirely in your browser — nothing you enter is uploaded.
How to use CORS Header Checker
- Paste one response header block, optionally starting with its HTTP status line.
- Enter the request origin and method. Blank values use https://app.example.com and GET; method comparison preserves case.
- Read origin and method-token observations, including every empty or duplicate value.
- Check credential mode, request headers and the actual browser exchange separately before making a CORS decision.
About this tool
Reviews one pasted response header block against an HTTP(S) or literal null origin and case-sensitive method token. Preserves empty and duplicate values. Reports origin and method-token observations; it cannot determine the browser outcome without credential mode, actual request headers and both preflight and actual responses. No network requests or server configuration changes.
Frequently asked questions
Does this tool prove that a browser request will work?
No. It reviews supplied header tokens only. Actual CORS processing also depends on credentials, request headers, preflight, the actual response, redirects and browser behavior.
How are methods compared?
HTTP method tokens are compared exactly and case-sensitively. A substring is not a match; wildcard behavior depends on credential mode.
Does it fetch a website or change CORS policy?
No. Paste captured headers from one response. The review stays in your browser and never changes server configuration.
Can I paste duplicate or empty fields?
Yes. Their values remain visible. Duplicate single-value CORS fields are flagged, and an empty field never consumes the next line.
What input formats are supported?
Use Name: value lines with an optional first HTTP status line. Folded lines, HTTP pseudo-header notation, multiple response blocks and body text are unsupported.