CORS Config Generator
Generate CORS headers/config for Nginx, Apache, Express, or Workers.
Configuration
Generated config
About the CORS Config Generator
Pick allowed origins, methods, and headers, then generate ready-to-paste CORS configuration for Nginx, Apache, Express (Node.js), or a Cloudflare Worker, with a warning when credentials are combined with a wildcard origin.
Examples
Express CORS
origin: https://example.comOutput
app.use(cors({ origin: "https://example.com" }))Keyboard shortcuts
- Copy the main outputCtrl / ⌘ + Shift + C
- Download the resultCtrl / ⌘ + S
- Share this toolCtrl / ⌘ + Shift + S
- Reset the inputsAlt + R
- Open the tool search paletteCtrl / ⌘ + K
Related tools
CSP Builder
Security
Build a Content-Security-Policy header from per-directive sources.
Permissions-Policy Header Generator
Security
Build a Permissions-Policy header controlling camera, geolocation and more.
Referrer Policy Generator
Security
Pick a Referrer-Policy value and get header/meta/server snippets.
Robots.txt Security Checker
Security
Scan robots.txt for accidental disclosure of sensitive paths.
Security Headers Auditor
Security
Grade HTTP response headers against security best practices.
X-Frame-Options / Clickjacking Checker
Security
Check if X-Frame-Options and CSP frame-ancestors block framing.
Frequently asked questions
Read more
- Understanding CORS errors and how to fix them
Why 'No Access-Control-Allow-Origin header' shows up, what the browser is actually enforcing, and the exact headers that fix each case.
- Testing APIs from the browser: what works, what CORS blocks, and why
How a browser-based REST client sends real requests, why some endpoints fail with a CORS error, and how to work around it without installing anything.
Comments
No login needed. Comments appear after a quick review.
Loading comments…
Version 1.0.0 · Updated 2026-08-06 · Runs entirely in your browser