# CORS Tester

Send a CORS preflight to a URL from our server and see, step by step, whether a browser would allow the request, with the response headers that would fix it.

Canonical: https://tamperbox.dev/cors-tester

Reviewed: 2026-10-16

## Capabilities and processing

Enter the URL a page calls and describe the request it would make: the calling page's origin, the method, the request header names and whether cookies are sent. When you press Send preflight, our server sends the URL an OPTIONS preflight with that origin, method and header names, and then, for GET and HEAD only and only when the preflight allows it, the request itself with just the origin. You can also paste the preflight response headers from your browser, which are checked in your browser.

The result walks through the browser's CORS check step by step: whether a preflight is needed, its status, Access-Control-Allow-Origin, Access-Control-Allow-Credentials, Access-Control-Allow-Methods and Access-Control-Allow-Headers, then the real response. Each step shows what the browser sends beside what the server answers, and a blocked request gets the response headers that would allow it, written for common servers.

## Example workflow

The sample endpoint allows the shop's own origin with cookies, but its preflight does not list Authorization, so a request with that header is blocked at step 4. Break it sends cookies to an endpoint that allows any origin, tries another origin, sends PUT with JSON, and shows an endpoint that does not handle OPTIONS and one whose preflight redirects.

## Limits and interpretation

Requests that could change data (POST, PUT, PATCH, DELETE) are never sent, and no cookies or header values are. A server can answer our server differently from a browser, by address, cookies or firewall, so a pass shows the server's rules, not proof from every browser. Nothing is stored.

## Related tools

[Security headers grader](https://tamperbox.dev/security-headers) · [Redirect chain checker](https://tamperbox.dev/redirect-checker) · [Website down checker](https://tamperbox.dev/website-down-checker) · [All tools](https://tamperbox.dev/) · [Privacy](https://tamperbox.dev/privacy)