CORS Header Validator
Check supplied CORS response headers against an origin and credential mode.
Processing stays in your browser. Checks only the origin and credentials response fields. Preflight methods, allowed headers, browser behavior, and actual server responses need separate testing.
How to use the cors header validator
Check supplied CORS response headers against an origin and credential mode. Complete the request origin, response headers, request credentials fields above. Choose Run tool, review the output, then copy or download the result.
Example
A wildcard allow-origin fails a request that includes credentials.
Good to know
Checks only the origin and credentials response fields. Preflight methods, allowed headers, browser behavior, and actual server responses need separate testing.