HTMLCORS Preflight Inspector
Paste a target API URL, browser origin, request method, request headers, and response headers to review a CORS preflight locally. Flags missing Access-Control-Allow-Origin, method/header mismatches, credential risks, missing Vary: Origin, max-age choices, and Private Network Access headers, then exports a curl OPTIONS probe, framework snippets, and a safe CI verification pack with placeholders. Nothing is uploaded.
Ctrl+Enter to run | Ctrl+K to switch tools | Recent button shows input history
Repeating this work? Turn this kind of browser utility into an API batch, MCP prompt, extension workflow, or shared team recipe.
Buy Pro Browse tool packsFAQ
What should I paste into CORS Preflight Inspector?
Paste the API URL, the web app origin, the method and headers your browser request will use, and the response headers from an OPTIONS request or failed browser request.
Does this send a request to my API?
No. It analyzes the text you paste and builds a curl preflight command plus a Node verification pack you can run from your own machine or CI.
What CORS problems does it flag?
It checks origin allow rules, credential compatibility, allowed methods, allowed headers, Vary: Origin, preflight cache lifetime, and Private Network Access headers.
What is in the verification pack?
The pack includes .env.example placeholders, cors-assertions.json, and a starter verify-cors-preflight.mjs file that probes OPTIONS headers and asserts the expected browser-facing policy.
Can it fix my framework automatically?
No. It provides reviewed Express and PHP examples that you should adapt to your real routes, auth model, and allowed origins.