In this article
What Is CORS?
Cross-Origin Resource Sharing (CORS) is a browser security mechanism that controls which web origins can access resources on your server. By default, browsers enforce the same-origin policy, blocking JavaScript from making requests to a different domain, port, or protocol.
CORS headers tell the browser which cross-origin requests to allow. Without the correct headers, API calls from a frontend on one domain to a backend on another will fail with a CORS error. A CORS headers generator creates the correct Access-Control-Allow-* headers for your server configuration.
How CORS Headers Work
CORS works through a set of HTTP response headers that the server sends to indicate which origins, methods, and headers are permitted for cross-origin requests.
- Access-Control-Allow-Origin — specifies which origins can access the resource (a specific domain, or * for any origin)
- Preflight requests — for non-simple requests, browsers send an OPTIONS request first to check if the actual request is allowed
- Credentials handling — Access-Control-Allow-Credentials: true allows cookies and auth headers, but requires a specific origin (not wildcard *)
Try it free — no signup required
Generate CORS Headers →When To Configure CORS
CORS configuration is required whenever your frontend and backend are served from different origins.
- API development — REST or GraphQL APIs accessed by frontend apps on different domains need CORS headers
- CDN setup — serving static assets from a CDN subdomain requires CORS for font files and API requests
- Microservices — services running on different ports during local development need CORS to communicate through the browser
Frequently Asked Questions
Why can't I just use Access-Control-Allow-Origin: * for everything?
The wildcard * allows any origin, which is fine for public APIs. However, it cannot be used with credentials (cookies, Authorization headers). If your API requires authentication, you must specify the exact origin. Wildcard also disables other CORS features like exposing custom response headers.
What is a preflight request?
A preflight is an HTTP OPTIONS request the browser sends automatically before the actual request. It checks whether the server allows the method, headers, and origin. Preflight occurs for requests with custom headers, methods other than GET/POST/HEAD, or Content-Type values outside form defaults.
How do I fix the 'No Access-Control-Allow-Origin header' error?
Add the Access-Control-Allow-Origin header to your server's response with the requesting origin's domain. For Express use the cors middleware, for Nginx add add_header directives, for Apache use Header set directives. Ensure the header is present on both the preflight OPTIONS response and the actual response.