使用方法
- Fill in the browser request section: choose an HTTP method, enter the requesting origin, set a Content-Type, and add any custom headers。
- Fill in the server policy section: set Access-Control-Allow-Origin, allowed methods, allowed headers, and the credentials flag。
- Read the result — the tool tells you whether the request is allowed or blocked, and whether a preflight OPTIONS request is required。
- Adjust any field to explore how changing the policy or request affects the CORS outcome。
範例
- Request from https://app.example.com with method POST and server policy Access-Control-Allow-Origin: * shows allowed, no preflight needed for simple requests。
- Adding a custom header X-Api-Key to the request while the server Allow-Headers list is empty triggers a preflight requirement and a blocked result。