Build a Content-Security-Policy header from 13 directives such as script-src, form-action and frame-ancestors.
CORS Headers Generator
Runs locally
Use CORS Headers Generator
What it does
Build the Access-Control-Allow-* response headers that let a web page on another origin call your API, from the origin, methods, headers and preflight cache time you choose.
It runs entirely in your browser: nothing you enter is uploaded.
Example
One trusted origin
https://app.example.comAccess-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400Gives Access-Control-Allow-Origin: https://app.example.com with the default methods, Content-Type and Authorization as allowed headers, and Max-Age 86400.
FAQ
Can I use * together with Allow Credentials?
No. Browsers reject Access-Control-Allow-Origin: * on credentialed requests, so name one exact origin; the generator does not check this. To allow several origins, your server must compare the request's Origin header with an allowlist, echo the match and send Vary: Origin.
Why is my Max-Age ignored?
Browsers cap preflight caching: Chromium at 7200 seconds (2 hours) and Firefox at 86400 seconds (24 hours), so larger values have no effect. The other values are copied as typed, without validation.
Does CORS protect my API from phishing pages?
Only partly. CORS decides which origins may read responses in a browser, not who can send requests, and reflecting any Origin with credentials lets a malicious page read your users' data. The headers are generated in your browser and nothing is uploaded.