CORS Checker — check Cross-Origin headers

The service sends an OPTIONS preflight request and a GET request with the header Origin: https://101ip.ru and analyses the CORS headers in the server response.

Main CORS headers

• Access-Control-Allow-Origin — domains permitted to access (* — everyone);
• Access-Control-Allow-Methods — allowed HTTP methods (GET, POST, PUT, DELETE…);
• Access-Control-Allow-Headers — allowed request headers;
• Access-Control-Allow-Credentials — whether cookies and authorisation are permitted;
• Access-Control-Max-Age — preflight response cache time (seconds);
• Access-Control-Expose-Headers — headers accessible to client-side JS code.

Important: wildcard and credentials

The value Access-Control-Allow-Origin: * forbids the use of Allow-Credentials: true. The browser will block such a response. For authenticated requests, a specific origin must be specified.

When to use CORS Checker

• Diagnosing "CORS policy" errors in the browser;
• Checking settings of a public API or CDN;
• Security audit — wildcard can be a vulnerability.

Frequently Asked Questions

• What should I do if CORS Checker shows "No CORS headers"?

  This means the server does not return Access-Control-Allow-Origin or any other CORS headers. You need to configure your server software (Nginx, Apache, IIS, or application code) to add the required headers. For example, in Nginx you can add the directive add_header Access-Control-Allow-Origin *;. After updating the configuration, re-run the check on 101ip.ru to confirm the headers appear.

• Why does CORS Checker report a preflight request error?

  A preflight OPTIONS request is sent by the browser to verify allowed methods and headers before the actual request. If the server does not respond to OPTIONS or returns an error (e.g. 403 or 500), CORS Checker will flag this. Make sure your server handles OPTIONS requests and returns the correct Access-Control-Allow-Methods and Access-Control-Allow-Headers headers. The problem often occurs when the server is not configured to accept the OPTIONS method.

• How can I check whether a site supports sending cookies via CORS?

  Look at the Access-Control-Allow-Credentials header in the CORS Checker results. If it is set to true, the server permits cookies and authorisation data. Note that in this case Access-Control-Allow-Origin must specify a concrete origin, not a wildcard (*). If the header is absent or set to false, cookies will not be transmitted. To enable this, configure your server accordingly.