CORS Policy Configurator

Cross-Origin Resource Sharing (CORS) is a security mechanism implemented by web browsers. It restricts a website from requesting assets or making API calls to a different domain (origin) than the one serving the web page, unless the target server explicitly allows it by returning specific HTTP headers.

Before a browser executes a "complex" cross-origin request (like a POST request with a JSON payload or custom headers), it first sends a silent OPTIONS request to the server. This is called a preflight request. The server must respond with the correct CORS headers approving the origin and methods, or the browser will block the actual request and throw an error.

For security reasons, if you set Access-Control-Allow-Credentials to true (meaning you want to allow the browser to pass cookies, authorization headers, or TLS client certificates across origins), the browser mandates that the Access-Control-Allow-Origin header must be a specific URL, not a wildcard.

The CORS specification does not allow multiple domains to be listed in a single Access-Control-Allow-Origin header. To support multiple origins securely, your backend (like Express.js) or reverse proxy (like NGINX) must read the incoming Origin header from the request, check if it matches an approved list, and dynamically echo that exact origin back in the response header.