What is CORS and why do I need these headers?

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that restricts web pages from making requests to a different domain than the one that served the page. Without the correct CORS headers on your server, browsers will block requests from your front-end app to your API if they are on different domains. Adding the right Access-Control headers tells the browser which cross-origin requests are allowed.

Is it safe to use Access-Control-Allow-Origin: *?

Using a wildcard origin (*) allows any website to call your API, which is fine for public APIs that don't use cookies or session credentials. However, if your API uses cookies or the Authorization header (credentials: true), you must specify exact origins — browsers will reject a wildcard combined with credentials.

What is an OPTIONS preflight request?

Before sending cross-origin requests with custom headers or non-simple methods (PUT, DELETE, PATCH), browsers send a preliminary OPTIONS request — called a preflight — to check whether the server allows the actual request. Your server must respond to OPTIONS with the correct CORS headers. The Max-Age setting controls how long browsers cache this preflight response.

How do I add CORS to an Express.js app?

Install the cors package (npm install cors), then use the generated Express.js snippet in your app. For a simple setup: const cors = require('cors'); app.use(cors(options)); — where options is the configuration object generated by this tool. Place the middleware before your route definitions.

How do I add CORS to Nginx?

Paste the generated Nginx snippet inside your server {} or location {} block in your nginx.conf or site configuration file. The snippet includes both the normal response headers and the OPTIONS preflight handling. Reload Nginx after saving: sudo nginx -s reload.

Can I allow multiple specific origins?

The Access-Control-Allow-Origin header only accepts a single origin or a wildcard. To support multiple specific origins, your server code must check the incoming request's Origin header against an allowlist and reflect the matching origin back. The Express.js output from this tool handles this pattern automatically when you add multiple origins.

Free CORS Config Tool

Generate CORS Headers
in Seconds

Configure allowed origins, methods, headers, and credentials visually. Get ready-to-paste CORS config for Express.js, Nginx, Apache, and raw HTTP headers — no back-end required.

🛡️

Multi-Framework Output

Get CORS config formatted for Express.js, Nginx, Apache, and raw HTTP headers — all from one form.

⚡

Instant Preview

See your CORS headers update in real time as you toggle origins, methods, and credential settings.

📋

One-Click Copy

Copy any configuration snippet to your clipboard and paste directly into your server or config file.

1Allowed Origins

Allow all origins (*)

https://example.com

Press Enter or comma to add. Multiple origins require server-side logic (auto-generated in Express.js output).

2Allowed Methods

3Allowed & Exposed Headers

Allowed Headers

Content-TypeAuthorization

Expose Headers (optional)

4Credentials & Preflight

Allow Credentials

Send cookies & auth headers cross-origin

Max Age (preflight cache)

seconds

Generated Config

// npm install cors
const cors = require('cors');

const corsOptions = {
  origin: 'https://example.com',
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  maxAge: 86400,
};

app.use(cors(corsOptions));

Configuration Summary

Origin: https://example.com
Methods: GET, POST, PUT, DELETE, OPTIONS
Credentials: disabled
Max-Age: 86400s

Frequently Asked Questions

Everything you need to know about CORS Headers Generator.

Generate CORS Headersin Seconds