Interpret CORS headers against request conditions.
Your input stays in this browser.
Starting points for your own code. Run them in the environment shown below.
Node.js 22+ · ES module (.mjs)
Current inputs apply only to fields used by the example. Selected files are not embedded.
Install dependencies
const origin = "https://app.example.com";
const credentials = true;
const headers = new Headers({
"Access-Control-Allow-Origin": "https://app.example.com",
"Access-Control-Allow-Credentials": "true",
});
const allowed = headers.get("access-control-allow-origin");
const originAllowed = allowed === origin || (allowed === "*" && !credentials);
const credentialsAllowed = !credentials || headers.get("access-control-allow-credentials") === "true";
console.log({ originAllowed, credentialsAllowed });
// Preflight method/headers must also pass; the browser enforces CORS.Interpret CORS headers against request conditions.
Interprets pasted headers only. It does not test server reachability or guarantee browser request success.
Text 1 MB
Split inputs that exceed the limit. If a format or algorithm is unsupported, choose a tool that matches your requirements instead of silently changing the format.