CORS config builder
Pick the origins, methods and headers and get CORS configuration for Spring, Express or nginx, with the rules browsers enforce checked for you.
Cross-origin requests without the guesswork
The browser's same-origin policy stops a page from reading responses from another origin (a different scheme, host or port). CORS is the opt-in: the server sends headers saying which origins, methods and headers it allows. When your front end on https://app.example.com calls an API on https://api.example.com, the API must send them, or the browser blocks the response and you get the familiar console error.
Enter the allowed origins, methods and headers, decide whether credentials (cookies, HTTP auth) are involved and choose a target. The builder produces the configuration for a Spring MVC WebMvcConfigurer, a single @CrossOrigin annotation, Spring Security's CorsConfigurationSource, Express with the cors package, nginx, or the raw response headers. It checks the rules browsers enforce and tells you when your settings are invalid, for example a wildcard with credentials.
Where CORS setups go wrong
- Spring Security rejects the preflight request before the MVC CORS configuration runs unless you also enable
http.cors(). - The server must answer
OPTIONSwithout requiring authentication, because browsers send no credentials on preflight. - With more than one allowed origin, the response must echo the matching origin and include
Vary: Origin. - Wildcards inside an origin are only possible with patterns, such as
https://*.example.cominallowedOriginPatterns.
Treat the generated code as a starting point and test it from the real front end. Nothing you type is uploaded.
Frequently asked questions
What is a CORS preflight request?
For requests that are not "simple" (methods other than GET, HEAD and POST, or custom headers such as Authorization), the browser first sends an OPTIONS request asking whether the real request is allowed. The server must answer with the Access-Control-Allow-* headers and a 2xx status, before any authentication check.
Why can I not combine * with credentials?
If a response may carry cookies or other credentials, a wildcard origin would let any site read it. Browsers therefore reject Access-Control-Allow-Origin: * when credentials are included, and Spring throws IllegalArgumentException for the same combination. List exact origins instead.
Why does CORS work in Postman but not in the browser?
CORS is a browser-enforced rule. Postman, curl and server code do not apply it. The failure you see in the browser console means the response lacked the right headers for that origin.
Does CORS protect my API?
No. It only controls which websites may read responses in a browser. Anyone can call your API directly, so authentication and authorization must still be enforced on the server.