h2check

CORS checker

Reads the CORS headers an endpoint returns for a given origin, including the preflight response, and says whether a browser would accept the answer.

Checker offline. Follow the manual steps below, they give the same answer.

What it checks

  • access-control-allow-origin for the origin you name, and whether the value is a star, an exact match, or a reflection of whatever was sent.
  • The preflight: what an OPTIONS request is told about allowed methods and headers.
  • access-control-allow-credentials, and whether it is combined with a star, which browsers refuse.
  • access-control-expose-headers, which decides what client JavaScript is allowed to read.
  • access-control-max-age, and how long a browser will skip the preflight.
  • Vary: Origin, without which a shared cache can serve one site the answer meant for another.

What is not stored

This checker runs on a server, and the server is not deployed yet, so the form above is disabled. The manual steps on the procedures below return the same answer from your own machine, and they are what the checker automates.

Limits

  • Reading headers is not the same as running a browser. A browser applies rules this checker only reports.
  • Only the URL you give is checked. A different route on the same host can answer differently.
  • An endpoint behind authentication answers this checker as an anonymous caller.

Procedures that explain the result

Put it on your own page

Link to it with the value filled in, and the checker runs as soon as the page opens.

<a href="https://h2check.org/tools/cors/">CORS checker</a>