SpeedDrain
W3C CORS Standard · Multi-Runtime · Preflight Simulator

CORS Header Generator & Builder

Construct valid Cross-Origin Resource Sharing security headers for Express, Nginx, Next.js, Apache, and Edge Workers with built-in credential conflict warnings.

CORS Archetype Presets:
Allowed HTTP Methods
Credentials & Cache Duration
Allowed Request Headers (Access-Control-Allow-Headers)
// Using 'cors' package in Express.js
import express from 'express';
import cors from 'cors';

const app = express();

const corsOptions = {
  origin: [
  "https://example.com",
  "https://app.example.com"
],
  methods: ["GET","POST","PUT","DELETE","OPTIONS"],
  allowedHeaders: ["Content-Type","Authorization","X-Requested-With"],
  exposedHeaders: ["Content-Length","X-Request-Id"],
  credentials: true,
  maxAge: 86400, // Cache preflight response in seconds
};

app.use(cors(corsOptions));
app.options('*', cors(corsOptions)); // Handle preflight across all routes

Interactive Browser Preflight Simulator

Test whether a client request originating from a web app will pass the generated CORS policy.

✓

Browser will permit request

Request will succeed! Browser will grant cross-origin access.

Understanding Cross-Origin Resource Sharing (CORS)

1. The Same-Origin Policy (SOP)

Web browsers enforce the Same-Origin Policy to isolate documents and prevent malicious websites from reading responses from other origins. A cross-origin request occurs whenever the protocol, domain, or port differ between client and server.

2. Preflight OPTIONS Requests

For requests that modify server state or send custom headers (like Authorization or Content-Type: application/json), the browser automatically dispatches an HTTP OPTIONS preflight to verify permission before the real payload is sent.

3. The Wildcard + Credentials Trap

The W3C specification strictly forbids using * wildcard with Access-Control-Allow-Credentials: true. When sending session cookies or HTTP auth, your server must read the request's Origin header, check an allowlist, and reflect back the exact origin.

Production Tip: Preflight Caching with Access-Control-Max-Age

Preflight OPTIONS requests introduce an extra network roundtrip before every API request, which can add 50-300ms of perceived latency. Setting Access-Control-Max-Age: 86400 instructs client browsers to cache approval for 24 hours, eliminating unnecessary preflight roundtrips for subsequent requests. Note that Chromium caps this value at 7200 seconds (2 hours), while Firefox allows up to 86400 seconds.