CORS Config Generator

Visually configure CORS cross-origin response headers. Output Nginx, Apache, Express.js and native HTTP header configs.

Presets:

Access-Control-Allow-Origin

Specify allowed cross-origin access sources

Access-Control-Allow-Methods

Allowed HTTP methods

GET

POST

PUT

DELETE

PATCH

OPTIONS

HEAD

Access-Control-Allow-Headers

Allowed custom request headers, comma-separated

Access-Control-Expose-Headers

Response headers exposed to the browser, comma-separated

Access-Control-Allow-Credentials

Whether to allow credentials (cookies)

Access-Control-Max-Age

Preflight request cache time (seconds)

Output Format

Select target server/framework for configuration

Generated Result

# CORS config - add to server or location block
add_header Access-Control-Allow-Origin "*" always;
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
add_header Access-Control-Max-Age "86400" always;

# Handle preflight requests
if ($request_method = OPTIONS) {
    return 204;
}

Usage

Features

CORS (Cross-Origin Resource Sharing) is an HTTP-header-based mechanism that allows servers to declare which cross-origin requests the browser should permit.

Steps

Choose origin mode, check allowed HTTP methods, fill in headers, select output format. Configuration is generated in real time.

Notes

Strongly avoid wildcard * in production. When Allow-Credentials is true, Allow-Origin must not be *; a specific domain is required.