Allow
Auth Cookie = TRUE
Warning
Origin must not be * when credentials are enabled
Developer Tools
CORS Troubleshooting and Config Generator
Diagnose cross-origin issues and generate Access-Control headers for Nginx, Node.js/Express, and Apache. Highlights invalid combinations such as credentials with wildcard origins.
DeveloperNetworkBackendSecurity
Quick switch:HTTP Status Explainer
Favorite this tool
No favorite storage mode has been selected.
Quick actions
Copy this tool URL or open the system share sheet on a supported device.
开发工具
CORS Config Builder
控制请求源：`*` 全放通或者特定域名 `https://a.com`。强烈不建议线上用 `*`。
前端如果用 `Fetch` 夹带自定义头部（如 `X-Auth-Token`），此处必须列出放行。
如果前端要读取 `Location`、`X-Request-Id` 等非简单响应头，需要在这里列出。
警告：开启带 Cookie 凭证通信后，Origin 绝对不能是 `*`！必须是显性的可信站名。
当允许指定 Origin 或带凭证时建议加上，避免 CDN / 代理缓存把一个来源的 CORS 响应串给另一个来源。
秒
对 OPTIONS 预检请求缓冲长效控制，省去频繁发送两次预检的开销。 当前配置会在这里显示风险和排查建议。
生成后可复制 Nginx / Node.js / Apache 配置。
Use cases
- Share correct CORS snippets with backend teammates
- Validate origin, methods, and headers before deployment
How to use
- Fill allowed origin, methods, and headers
- Review risk warnings for credential + * combinations
- Copy Nginx, Node, Apache, or preflight curl snippets
Example input and output
FAQ
Is Apache supported?
Core directives translate across servers; Nginx and Node snippets are the most common starting points.
Tools
Related tools
Continue with another translated tool for a nearby task.
HTTP Status Explainer
HTTP Status Code Reference and Troubleshooting
Search HTTP status codes from 100 to 511 with plain-language meanings, typical causes, and fix hints. Filter by class and copy individual cards locally.
Developer Network Reference