CORS Debugger
Paste the request origin, method, and headers on one side, and the response headers you got back on the other. This walks through the same algorithm a browser uses, step by step, and names the exact header or rule that's failing — runs entirely in your browser.
Request
Response headers received
Step-by-step
✗ This request is blocked by CORS
Simple request — no preflight.
- Info Cross-origin request
Request origin 'https://app.example.com' differs from the target origin 'https://api.example.com' in host ('app.example.com' vs 'api.example.com') — this is a cross-origin request, so the browser enforces CORS.
- Info Simple request
This qualifies as a CORS 'simple request' — a safelisted method with only CORS-safelisted headers — so the browser sends it directly with no preflight.
- Fail Actual response: Access-Control-Allow-Origin
Response sets 'Access-Control-Allow-Origin: *', but the request uses credentials (cookies or HTTP auth). Browsers reject a wildcard origin whenever credentials are involved, even if Access-Control-Allow-Credentials is also set — the server must echo back the exact request origin instead of '*'.
- Pass Actual response: Access-Control-Allow-Credentials
Access-Control-Allow-Credentials: true is present, as required for a credentialed request.
- Fail Result
The request may reach the server, but the browser blocks JavaScript from reading the response — the check above that failed is why.
- Info Response headers visible to JavaScript
By default, JS can only read these response headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma. No Access-Control-Expose-Headers is set, so any other header (e.g. a custom X-* header) is present in the response but invisible to response.headers.get(...).