CORS 模拟器

浏览器请求 + 服务器策略 → 允许/阻止 + preflight 必需

Browser request

Method

Origin

Content-Type

Custom headers

Authorization

Server policy

Access-Control-Allow-Origin

Allow-Methods

GETPOST

Allow-Headers

AuthorizationContent-Type

Allow-Credentials

✓ Allowed · Preflight (OPTIONS) required

Reasons

• Preflight required (GET method or non-simple headers)

Preflight (OPTIONS) response headers

Access-Control-Allow-Origin	`https://example.com`
Access-Control-Allow-Methods	`GET, POST`
Access-Control-Allow-Headers	`Authorization, Content-Type`

使用方法

Fill in the browser request section: choose an HTTP method, enter the requesting origin, set a Content-Type, and add any custom headers.
Fill in the server policy section: set Access-Control-Allow-Origin, allowed methods, allowed headers, and the credentials flag.
Read the result — the tool tells you whether the request is allowed or blocked, and whether a preflight OPTIONS request is required.
Adjust any field to explore how changing the policy or request affects the CORS outcome.

示例

Request from https://app.example.com with method POST and server policy Access-Control-Allow-Origin: * shows allowed, no preflight needed for simple requests.
Adding a custom header X-Api-Key to the request while the server Allow-Headers list is empty triggers a preflight requirement and a blocked result.