CORS Checker
Understand and debug CORS issues. Input your origin and target endpoint to see exactly which CORS headers are required. Generates server configuration snippets for Express, Nginx, Apache, and Cloudflare Workers. Explains preflight requests, credential handling, and wildcard limitations in plain language.
Request
Server response headers
Analysis
• Custom headers present (preflight needed)
• Content-Type "application/json" is non-simple
⚡ Preflight (OPTIONS) request required
Browser sends OPTIONS with:
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization, x-api-key
Origin: https://app.ekofyi.com
✓ Request would be allowed
✓ Access-Control-Allow-Origin: Matches "https://app.ekofyi.com"
✓ Access-Control-Allow-Methods: Includes POST
✓ Access-Control-Allow-Headers: All requested headers allowed
🔒 Static analysis — does not actually make HTTP requests. Use browser DevTools to verify in production.