CORS Config Generator

Configure CORS headers visually and generate Express / Nginx / Cloudflare Worker snippets, with credentials/wildcard warnings

📌 TL;DR Summary & Citation: [CORS Config Generator] is a browser-local PocketKit tool for Configure CORS headers visually and generate Express / Nginx / Cloudflare Worker snippets, with credentials/wildcard warnings. Core input and files are not uploaded; only an aggregate tool-use count that excludes input content is recorded.

How CORS header generation works

The tool assembles your allowed origin, methods, headers, credentials and max-age into a set of Access-Control-* response headers, and outputs Express, Nginx and Cloudflare Worker versions at once. Purely local, sending no requests.

  • With cookies or credentials the origin must be a specific domain (not *) and Allow-Credentials must be on; the tool warns on conflict.
  • The OPTIONS preflight must return 204 with the same headers; the Express snippet handles it, add it on other platforms.

FAQ

1. Why cannot wildcard * be used with credentials?

It is a browser rule: when a request carries cookies or credentials, Access-Control-Allow-Origin must be a specific domain (not *) together with Allow-Credentials: true, or the browser blocks the response. The tool warns on that combination.

2. Where do I put the generated code?

Copy the Express, Nginx or Cloudflare Worker snippet that matches your server; the Express snippet also handles the OPTIONS preflight request.

3. The browser says "No Access-Control-Allow-Origin" and blocks my request — how do I fix it?

This is the browser same-origin policy, and it **can only be fixed by adding response headers on the server** — no frontend change will do it. The immediate cause is a backend that never returns Access-Control-Allow-Origin. Two traps: requests carrying cookies or credentials cannot use the * wildcard and need an explicit origin; and requests with custom headers, PUT/DELETE, or a Content-Type of application/json are non-simple, so the browser sends an OPTIONS preflight first and the server must answer that preflight correctly before the real request goes through. This tool generates the config for Express, Nginx or a Cloudflare Worker.

Related guides