BEFORE YOU START

A request can return HTTP 200 and still be blocked by the browser. Inspect OPTIONS and the real method as distinct exchanges, and compare each response with the requesting Origin.

FOLLOW ALONGOpen the live HTTP / CORS Checker workspace
01

Capture the requesting Origin

Scheme, host, and port all belong to the Origin. Similar-looking development URLs are not interchangeable.

EXAMPLE
https://app.example.com
02

Inspect the preflight

For non-simple requests, check OPTIONS status plus Access-Control-Allow-Origin, Methods, and Headers.

EXAMPLE
OPTIONS /api
03

Inspect redirects and the final response

A redirect or error handler may omit CORS headers even when the main route includes them.

EXAMPLE
3xx → final URL
04

Handle credentials deliberately

Credentialed requests cannot combine Access-Control-Allow-Credentials: true with a wildcard origin.

EXAMPLE
Access-Control-Allow-Credentials: true
Key takeaways
  • CORS is enforced by browsers, not by curl.
  • Preflight and actual responses both matter.
  • Status, redirect, and CORS failures should be diagnosed separately.