~/tools / 12 / cors-preflight-options

CORS Headers Inspector

CORS failures are diagnosed by reading headers, so learn the three shapes by heart: the permissive wildcard 204 that unblocks everything, the credentialed setup where Allow-Origin must name one exact origin (wildcards break withCredentials), and the misconfigured response missing Access-Control-Allow-Origin — the one producing that red console error you were just googling.

compose payload

template preset

status code latency (ms)

response body — live JSON editor

— validating —

exported mock url

—

▸ open mock ↗

simulated response headers

access-control-allow-origin: *

access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS

access-control-allow-headers: Content-Type, Authorization, X-Requested-With

access-control-max-age: 86400

vary: Origin

$ man cors-preflight

Everything above is encoded into the #data= fragment of the exported URL — deflated and base64url-packed by your browser. Fragments are never sent to any server, so this mock is shareable and private. Paste the URL anywhere: a teammate's browser decodes it identically.

CORS Headers Inspector

grep -i related-searches

ln -s ./related-tools