Can I allow multiple origins?

Yes, enter a comma-separated list — Express output handles an array, while Nginx/Apache snippets use the first origin as a starting point.

Why can't I combine wildcard origin with credentials?

Browsers reject 'Access-Control-Allow-Credentials: true' when the origin is '*' for security reasons.

Does this test my actual server?

No, it only generates configuration text locally — apply and test it against your real server.

CORS Config Generator

Generate CORS headers/config for Nginx, Apache, Express, or Workers.

Works Offline

Privacy First

No Login

No API

Target server

Allow credentials

Configuration

Allowed origins

Comma-separated list.

Allowed methods

Allowed headers

Comma-separated list.

Generated config

import cors from "cors";

app.use(cors({
  origin: "https://example.com",
  methods: ["GET","POST"],
  allowedHeaders: ["Content-Type","Authorization"],
  credentials: false,
}));

About the CORS Config Generator

Pick allowed origins, methods, and headers, then generate ready-to-paste CORS configuration for Nginx, Apache, Express (Node.js), or a Cloudflare Worker, with a warning when credentials are combined with a wildcard origin.

Examples

Express CORS

origin: https://example.com

Output

app.use(cors({ origin: "https://example.com" }))

Related tools

Htpasswd Generator

Security

Generate .htpasswd lines using SHA-1 or plain text.

CSP Builder

Security

Build a Content-Security-Policy header from per-directive sources.

JWT Inspector

Security

Decode a JWT and audit its claims for common issues.

Password Strength Checker

Security

Estimate password entropy, crack time, and get actionable advice.

Robots.txt Security Checker

Security

Scan robots.txt for accidental disclosure of sensitive paths.

Secret Scanner

Security

Scan pasted code or text for likely leaked secrets.

Frequently asked questions

Version 1.0.0 · Updated 2026-08-06 · Runs entirely in your browser