API reference

Start with a browser request

Use /api/cors/open for a public cross-origin fetch without credentials. This example runs from anotherexample.com or another origin.

const response = await fetch('https://cors.anotherexample.com/api/cors/open');
console.log(response.status, await response.json());

Inspect a request with curl

/api/echo returns the request method, path, query, safe headers, body, and timestamp. Use curl or a same-origin page. JSON, URL-encoded form data, and plain text are supported up to 64 KB. Use sample data.

curl -i 'https://anotherexample.com/api/echo' \
  -H 'Content-Type: text/plain' --data-binary 'hello from curl'

Configure a CORS response

/api/cors/lab accepts any method. An OPTIONS request returns the configured preflight status and headers with an empty body. Other requests normally return JSON with the lab settings and the echoed request.

allowOrigin

Defaults to *. Use echo to reflect the request Origin, none to omit the header, null for that literal value, or an HTTP(S) origin such as https://app.example.

credentials

Use true to send Access-Control-Allow-Credentials: true. The default is false. For credentialed browser reads, pair it with allowOrigin=echo or the page’s exact origin.

methods

A comma-separated method list. Defaults to GET, POST, OPTIONS. Use none to omit the header.

headers

A comma-separated request header list. Defaults to the requested preflight headers when supplied, otherwise Content-Type. Use none to omit the header.

expose and maxAge

Set exposed response header names and preflight cache duration in seconds. Both headers are omitted by default.

preflightStatus and status

Integer HTTP statuses from 200 to 599. Default to 204 for OPTIONS and 200 for other requests. Out-of-range or invalid values use the defaults.

delay

Response delay in milliseconds, from 0 to 3000. Defaults to 0. Values outside the range are capped at the nearest limit.

For a credentialed preflight, try this request:

curl -i -X OPTIONS 'https://cors.anotherexample.com/api/cors/lab?allowOrigin=echo&credentials=true' \
  -H 'Origin: https://app.example' \
  -H 'Access-Control-Request-Method: POST' \
  -H 'Access-Control-Request-Headers: Content-Type'

To watch the browser enforce these settings, try the CORS Playground.

Errors and limits

Invalid allowOrigin or credentials values receive HTTP 400 with a JSON error message. Unknown API paths return HTTP 404 with the same JSON shape.

The API limit is 120 requests per minute per client IP. /api/health is exempt. /api/delay/:ms also has a limit of 20 requests per minute.