CORS debugging workflow

Debug a CORS error by reading the actual headers

The browser console message rarely explains the fix. Read the actual CORS headers the server returned to find the mismatch.

Open CORS Header AnalyzerView the workflow
01

Match request and response headers

Most CORS failures come down to one mismatched header between the request and the response.

1

Capture the failing request

Copy the request origin and the response CORS headers.

2

Compare the origin values

Confirm the allowed origin matches the requesting origin exactly.

3

Check methods and headers allowed

Confirm the request method and custom headers are permitted.

4

Check credentials handling

Confirm credentials mode matches the allow-credentials header.

02

The usual causes

  • Missing Access-Control-Allow-Origin on the server
  • Preflight OPTIONS requests not handled
  • Wrong allowed methods or headers in the response
  • Credentials requests that require an exact origin
03

Isolate the failing header

  1. 1

    Reproduce the request and capture the response headers with the CORS header analyzer.

  2. 2

    Compare the required and received headers: Origin, Access-Control-Allow-Origin, and Access-Control-Allow-Headers.

  3. 3

    Fix the server configuration for the missing header and retest.

04

Frequent CORS mistakes

  • A wildcard origin is used together with credentials
  • The allowed origin is missing a scheme or port
  • A custom header is sent but not included in allowed headers
  • The preflight response is missing entirely
05

Configure CORS deliberately

  • List explicit origins instead of a wildcard when credentials are used
  • Keep allowed methods and headers as narrow as the client needs
  • Test both simple and preflighted requests
  • Document the CORS configuration next to the API
06

Frequently asked questions

What is a preflight request?

For cross-origin requests with custom headers or methods, the browser first sends an OPTIONS request and only proceeds when the server allows it.

Why does Access-Control-Allow-Origin: * fail with credentials?

Browsers require an explicit origin, not a wildcard, when credentials are included.

Can I test CORS without deploying?

Yes. Analyze the response headers locally and simulate the browser checks with the analyzer.

Are my requests uploaded?

No. Analysis runs locally in your browser.

07

Analysis runs in the browser

Pasted headers are analyzed locally. Remove authentication tokens before sharing a CORS debugging session.

Open CORS Header Analyzer