CORS Header Generator

Configure allowed origins, methods, and headers to generate raw CORS HTTP headers, plus ready-to-use snippets for Express, Next.js Route Handlers, and Nginx.

Allowed originAllowed headersMax age (seconds)

Allowed methods

Allow any origin (*)Allow credentials (cookies)

Raw HTTP headers

Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400

Express / Node middleware

app.use((req, res, next) => {
  res.setHeader("Access-Control-Allow-Origin", "https://example.com");
  res.setHeader("Access-Control-Allow-Methods", "GET, POST");
  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
  if (req.method === "OPTIONS") return res.sendStatus(204);
  next();
});

Next.js Route Handler (OPTIONS)

export async function OPTIONS() {
  return new Response(null, {
    status: 204,
    headers: {
      "Access-Control-Allow-Origin": "https://example.com",
      "Access-Control-Allow-Methods": "GET, POST",
      "Access-Control-Allow-Headers": "Content-Type, Authorization",
    },
  });
}

Nginx

add_header 'Access-Control-Allow-Origin' 'https://example.com' always;
add_header 'Access-Control-Allow-Methods' 'GET, POST' always;
add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization' always;

Ad space

Frequently asked questions

Why is my browser blocking a cross-origin request?+

Browsers enforce CORS by default for security: a page from one origin can't read responses from another origin unless that server explicitly allows it via CORS headers. This is a browser-side restriction, not a server or network error.

Can I use * with credentials enabled?+

No, browsers reject the combination of a wildcard origin (*) and Access-Control-Allow-Credentials: true for security reasons. Specify an exact origin if you need credentials.

What does the Access-Control-Max-Age header do?+

It tells the browser how long (in seconds) it can cache the result of a CORS preflight OPTIONS request, avoiding a preflight round-trip on every request.