Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To enable CORS, configure the server that returns the API response to send the appropriate Access-Control-Allow-* headers. In Apache, use Header from mod_headers; in Nginx, use add_header. Allow only the origins you trust, handle preflight OPTIONS requests when needed, and use an explicit origin—not *—for requests that include credentials.
What enabling CORS actually does
Cross-Origin Resource Sharing (CORS) is a browser security mechanism. When a page makes a cross-origin request, the browser sends an Origin request header. The server opts in by returning CORS response headers, and the browser uses them to decide whether JavaScript may read the response. Setting headers does not disable browser security or grant access to a person who cannot otherwise reach the server; it tells browsers which web origins may read eligible responses.
CORS is not a substitute for authentication, authorization, or CSRF protections. A CORS rule should not be treated as a way to secure an API: clients outside the browser can make requests regardless of browser CORS enforcement. Protect private data and operations with the API’s normal access controls.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose an origin policy before editing configuration
One trusted frontend origin
If an API should be readable by one web app, allow its exact origin, for example https://app.example. An origin consists of the scheme, host, and optional port. It is not a path: https://app.example/page is not an origin value. Scheme and port differences matter, so http://app.example and https://app.example are distinct.
#1 Best Overall
Public, non-credentialed access
For a genuinely public API whose browser requests do not use credentials, Access-Control-Allow-Origin: * can allow any origin to read responses. Do not use the wildcard merely to make an error disappear. Private APIs should use a specific origin or a validated allowlist.
Requests that use credentials
For browser requests that include cookies or other credentials, return the exact approved origin and Access-Control-Allow-Credentials: true. Browsers reject a credentialed response that combines Access-Control-Allow-Credentials: true with Access-Control-Allow-Origin: *. Only permit credentialed access for origins that should be able to act with those credentials.
Several approved origins
A response cannot list multiple origins in Access-Control-Allow-Origin. Instead, validate the incoming Origin against a fixed allowlist, return that origin only if it matches, and send Vary: Origin so caches distinguish responses selected for different origins. Never reflect any incoming origin without validation. Avoid allowing the special value null: browser documents with opaque origins can send it, so it is not a safe shorthand for a trusted site.
Enable CORS in Apache
1. Make sure mod_headers is available
Apache’s Header directive is provided by mod_headers. Enable or load that module using the method for your operating system and Apache installation. If Apache reports that Header is an invalid command, the module is not loaded in the server handling the request.
2. Add headers where the API response is served
Put the rule in the relevant virtual host or route configuration so it applies to the API response, not just to an unrelated site or static directory. Apache permits the directive in server configuration, virtual-host, Directory, Location, Files, and .htaccess contexts, subject to the server’s configuration and override rules.
<IfModule mod_headers.c>
Header always set Access-Control-Allow-Origin "https://app.example"
Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
</IfModule>Replace the example origin and method/header lists with the values your frontend actually needs. The methods header describes methods the cross-origin operation may use; the headers header authorizes request headers such as Authorization or Content-Type. Do not add methods or headers simply as a precaution.
3. Add credentials only when required
If the application relies on browser credentials, add this directive and retain an explicit approved origin:
Header always set Access-Control-Allow-Credentials "true"Do not change the origin to * in this configuration. If multiple origins are supported, use an allowlist-aware implementation rather than a fixed header or unvalidated reflection.
4. Apply and verify the configuration
Validate the configuration and reload or restart Apache using the service procedure for your installation. Then request the API with an Origin header and inspect the response headers. If the API is behind a proxy or application server, confirm which layer actually sends the response; a header added to a different layer may not reach the browser.
Enable CORS in Nginx
1. Add rules to the API location
Place the rules in the server block or, preferably when practical, the location that handles the API response. The example uses always so the headers are added regardless of response status code.
Rank #3
- Used Book in Good Condition
location /api/ {
add_header Access-Control-Allow-Origin "https://app.example" always;
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
}Adjust the URL prefix and allowed values to match your application. Nginx accepts add_header in http, server, location, and if in location contexts. The always parameter makes the header apply regardless of response code; without it, headers can be absent on responses outside the directive’s default status-code behavior.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →2. Account for Nginx inheritance
Nginx inherits add_header directives from a higher configuration level only when the current level has no add_header directives of its own. A nested location that defines any add_header can therefore stop inheriting the outer CORS set. Repeat the required CORS directives in that location, or deliberately structure the configuration so the correct set applies. Check the effective location for the requested URI, not only the top-level server block.
3. Configure credentials and cache variation if needed
For credentialed requests, set an explicit allowed origin and add:
add_header Access-Control-Allow-Credentials "true" always;For a response whose origin is selected dynamically from a validated allowlist, also send Vary: Origin. Ensure this header is present on the relevant responses and is not overwritten by another layer. Do not combine credentials with a wildcard origin.
4. Test and reload
Check the configuration with Nginx’s configuration-test command before reloading the service. Then test the actual API path. A syntactically valid rule in the wrong server or location block will not fix the response, and a more specific location may change which headers are applied.
Recommended Free Tools
Handle CORS preflight OPTIONS requests
For a cross-origin request that is not a CORS-safelisted simple request, the browser first sends a preflight request using OPTIONS. It asks whether the origin, planned method, and planned request headers are permitted. This commonly arises when the frontend uses methods beyond the simple set or sends headers such as Authorization or a non-safelisted content type.
The preflight response must be successful and include an allowed origin plus suitable Access-Control-Allow-Methods and Access-Control-Allow-Headers values. The actual request must also receive the appropriate CORS response headers. If the server routes OPTIONS elsewhere, rejects it, or omits the requested method/header, the browser will stop before sending the actual request.
The Apache and Nginx snippets above provide the authorization headers, but they do not by themselves guarantee that the application or server returns a successful response to every preflight. Ensure the route accepts the necessary OPTIONS request and returns the CORS headers on that response as well. Avoid assuming that a successful direct GET test proves preflight works.
Allow multiple origins safely
For more than one frontend, the server-side logic should follow this sequence:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Read the request’s
Originvalue. - Compare it against a finite list of approved origins, including the exact scheme and host (and port, if applicable).
- If it matches, set
Access-Control-Allow-Originto that matched origin. If it does not match, do not grant it access. - Send
Vary: Originbecause the response varies according to the request origin. - For credentialed requests, add
Access-Control-Allow-Credentials: trueonly when appropriate, and never use a wildcard origin.
Apache and Nginx can serve the static single-origin examples directly. A dynamic allowlist usually requires application logic, a carefully controlled mapping, or another mechanism capable of checking the origin before returning headers. Do not create a configuration that simply copies arbitrary input into the response header.
Best Value
Test the actual and preflight responses
Use a command-line request to see what the server sends; command-line clients do not enforce browser CORS rules, so this checks headers rather than proving browser access.
curl -i -H "Origin: https://app.example" https://api.example/api/resourceFor a preflight-like check, include the origin and the browser’s requested method and headers:
curl -i -X OPTIONS
-H "Origin: https://app.example"
-H "Access-Control-Request-Method: POST"
-H "Access-Control-Request-Headers: content-type,authorization"
https://api.example/api/resourceReplace the example host, path, method, and header list with the values from the failing browser request. Inspect status code and response headers for both requests, then verify in browser developer tools that the browser’s real preflight and actual request receive the expected responses.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot missing headers and failed requests
Access-Control-Allow-Origin is missing
- Apache: Check that
mod_headersis loaded and that the directive is in the virtual host or route handling the API. Verify that an upstream application or proxy response is not taking a different path. - Nginx: Check which
locationmatches the URL. A nested location may have its ownadd_headerdirectives and thereby fail to inherit the outer CORS set. - Error response: If headers appear on success but not on errors in Nginx, use
alwayswhere those responses need CORS headers. Apache’sHeader always setcan likewise apply the rule beyond ordinary successful responses. - Redirect: Inspect each redirect and its final destination. The browser may be reporting the response at a different URL or from a different server than the one configured.
Preflight fails although GET works
Inspect the OPTIONS response separately. Confirm it succeeds and authorizes the requested method and every requested header. A browser may send a preflight because of the method or headers even when a simple GET to the same URL succeeds.
Credentials fail
Confirm that the response uses the exact allowed origin, not *, and includes Access-Control-Allow-Credentials: true if credentials are intended. Also check that the browser request is actually configured to send credentials and that the server’s normal authentication permits it.
It works for one origin but not another
Compare origins exactly, including scheme and port. For dynamically chosen origins, check the allowlist match and ensure caches receive Vary: Origin. A cached response selected for one origin must not be reused as though it had been selected for another.
It works in curl but not in the browser
Curl reports server output without enforcing CORS. Reproduce the browser’s origin, method, requested headers, and credential behavior; inspect the preflight and actual response in developer tools. Browser console messages often identify which required header is missing or invalid.
Or skip the browser setup
ScreenshotNeo is a website screenshot API and MCP server, not a way to configure CORS or make a browser accept a blocked cross-origin response. If your separate task is capturing a page as an image, one GET request can return an image or PDF. The service removes cookie and consent banners, newsletter popups, and chat widgets before capture; bot checks, blank pages, and failed loads are not billed. Its MCP server lets AI agents take screenshots. The free plan includes 1,000 screenshots per month with no card, and paid plans start at $5 for 3,000. See ScreenshotNeo and the API documentation.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSign up free for 1,000 screenshots a month with no card.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
