CORS Origin Checker

Compare one valid Access-Control-Allow-Origin value with candidate origins using exact matching or the '*' wildcard

Input

Loading editor...

Output

Output will appear here...

What is CORS Origin Checker

Written by Giorgos Kostas. Last reviewed: April 18, 2026

CORS Origin Checker compares a single `Access-Control-Allow-Origin` value with candidate origins. It supports one serialized origin, the literal `null`, or the `*` wildcard; comma-separated origins and subdomain patterns such as `*.example.com` are invalid header values.

It flags that `*` cannot authorize credentialed requests. It does not check the separate `Access-Control-Allow-Credentials` header.

Why use it

Validate CORS rules before deploying.
Triage 'blocked by CORS' errors quickly.
Teach CORS behaviour with real examples.
Check scheme, host, and port with exact origin matching.
See when the `*` wildcard is incompatible with credentials.

Features

Exact origin matching
Rejects comma lists and subdomain patterns
Explains wildcard credential limits
Batch test many origins
Zero-upload CORS Origin pipeline, nothing touches a server

How to use CORS Origin Checker

Paste allow-origin. Line 1 — `*` or one origin, not a list.
Paste origins. Lines 2+ — one origin per line.
Run. Each origin gets an ALLOWED / BLOCKED verdict.

Example (before/after)

Input

https://admin.example.org
https://admin.example.org
https://attacker.com

Verdicts

Allow-Origin header value: https://admin.example.org
Credentials: this checker does not inspect Access-Control-Allow-Credentials.

ALLOWED (exact match)               https://admin.example.org
BLOCKED                             https://attacker.com

Common errors

Wildcard + credentials

Browsers block '*' with credentials.

Fix: Return one allowlisted request origin and set Access-Control-Allow-Credentials to true.

Trailing slashes

Origins are hostnames, not URLs with paths.

Fix: Remove paths — include scheme + host only.

FAQ

Does it support wildcard subdomains?

No. `Access-Control-Allow-Origin` accepts `*`, `null`, or one serialized origin; `*.example.com` is not a valid subdomain wildcard value.

Does it test credentials-mode?

It flags that `*` cannot authorize credentialed requests. It does not inspect `Access-Control-Allow-Credentials`.

Is input uploaded?

No — the checker runs client-side.

Does it make real requests?

No — it's a pure rule checker.

Does it handle protocol mismatches?

Yes — https://… and http://… are treated as distinct origins.

Related tools

Pair with HTTP, URL, and networking tools. You can also browse the full Security & Web Hardening category for more options.

HTTP Header Inspector

Paste response headers to audit HSTS, CSP, CORS, X-Powered-By disclosure, and Set-Cookie flags

URL Parser

Parse a URL into scheme, host, port, path, query parameters, fragment, and origin — fully client-side

User-Agent Parser

Parse a User-Agent string into browser, version, operating system, device type, and bot status

JWT Debugger

Decode JWTs, verify HMAC, RSA, and EC signatures (paste secret/PEM or fetch JWKS), inspect claims, and visualize the exp/nbf/iat timeline

CIDR Calculator

Calculate network, broadcast, usable hosts, subnet mask, and wildcard for any IPv4 CIDR

Base64 Encoder/Decoder

Encode or decode Base64 strings

CORS Tester

Send a real OPTIONS preflight and the actual request from a server proxy and inspect the per-rule CORS verdict for any origin

SSL Chain Inspector

Probe a host:port and render the full TLS certificate chain with subject, issuer, SAN, key, signature, fingerprints, and days-until-expiry

CSP Policy Builder

Build a Content Security Policy header from per-directive cards with chip-style sources, presets, and a live header + meta-tag preview