CORS Header Generator

About this tool

CORS errors block more launches than almost anything else — and most "fixes" pasted from forums are subtly wrong. This generator builds a correct CORS configuration for your stack: allowed origin, methods, headers, max-age and credentials, plus the preflight OPTIONS handling most snippets forget.

It also refuses invalid combinations, like wildcard origin together with credentials, explaining why browsers reject them.

How to use it

1. Enter your allowed origin (use a real origin, not *, if you send cookies).
2. List the methods and request headers your API accepts.
3. Pick your target: Apache .htaccess, Nginx, PHP or Node/Express.
4. Copy the config — preflight handling is included.

Useful ways to apply it

• Fixing "blocked by CORS policy" errors on a new API.
• Allowing a JS frontend on one domain to call an API on another.
• Configuring shared hosting (.htaccess) without server access.
• Standardizing CORS across environments with one source of truth.

Worked example

Origin https://app.example.com; credentials yes; methods GET, POST

Access-Control-Allow-Origin: https://app.example.com; Access-Control-Allow-Credentials: true

Edge cases to check

• Wildcard origin cannot be used for credentialed requests.
• Reflecting every Origin header without an allowlist is unsafe.
• Preflight responses need correct allowed method/header handling and Vary behavior.

Known limitations

Generated headers are a starting point. CORS must be enforced by server logic that knows which origins are actually trusted.