# CORS Headers Generator

URL: https://phishdestroy.io/developer-tools/cors-headers-generator
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Build the Access-Control-Allow-* response headers that let a web page on another origin call your API, from the origin, methods, headers and preflight cache time you choose.

## Example input

One trusted origin

```
https://app.example.com
```

Gives Access-Control-Allow-Origin: https://app.example.com with the default methods, Content-Type and Authorization as allowed headers, and Max-Age 86400.

## FAQ

### Can I use * together with Allow Credentials?

No. Browsers reject Access-Control-Allow-Origin: * on credentialed requests, so name one exact origin; the generator does not check this. To allow several origins, your server must compare the request's Origin header with an allowlist, echo the match and send Vary: Origin.

### Why is my Max-Age ignored?

Browsers cap preflight caching: Chromium at 7200 seconds (2 hours) and Firefox at 86400 seconds (24 hours), so larger values have no effect. The other values are copied as typed, without validation.

### Does CORS protect my API from phishing pages?

Only partly. CORS decides which origins may read responses in a browser, not who can send requests, and reflecting any Origin with credentials lets a malicious page read your users' data. The headers are generated in your browser and nothing is uploaded.

## Related tools

- [CSP Header Builder](https://phishdestroy.io/developer-tools/csp-header-builder)
- [HTTP Headers Reference](https://phishdestroy.io/developer-tools/http-headers-reference)
- [Cookie & Set-Cookie Parser](https://phishdestroy.io/developer-tools/cookie-parser)
- [HTTP Request Builder](https://phishdestroy.io/developer-tools/http-request-builder)
- [Apache .htaccess Snippets](https://phishdestroy.io/developer-tools/htaccess-snippets)

All tools: https://phishdestroy.io/developer-tools