You can run a Go-based CORS proxy locally with corsproxy or Docker. This tutorial follows the Go install route for zachcheung/corsproxy and shows how to restrict the destinations it can reach. “In 60 seconds” is a title, not a verified setup time: the project documents the commands, but no timed run is established here.
What this proxy changes
A browser normally blocks JavaScript from reading cross-origin responses unless the API’s server permits the requesting origin through CORS headers. A proxy changes the request path: browser code requests a URL on the proxy, and the proxy makes the request to the third-party destination. The browser then receives the proxy’s response, subject to the proxy’s own CORS configuration and the destination’s behavior. This does not grant access to APIs that require credentials you do not have, nor does it make an API’s terms or access controls disappear.
As an Amazon Associate I earn from qualifying purchases.
The project demonstrated here is github.com/zachcheung/corsproxy. Its README documents Go installation, a Docker image, destination restrictions, and an example localhost request URL. A separate Go project also describes itself as a zero-dependency Go version of CORS Anywhere, so “a Go CORS proxy” does not identify a unique implementation. Check each repository’s instructions and release before using commands from it.
Install the selected Go implementation
The project README documents this Go installation command:
#1 Best Overall
go install github.com/zachcheung/corsproxy/cmd/corsproxy@latestThis follows the repository’s documented @latest install path; it does not pin a version. If reproducible builds matter, choose and record a specific release or commit using the project’s own versioning instructions rather than assuming that @latest will remain unchanged.
The alternative documented container image is ghcr.io/zachcheung/corsproxy. Consult the repository’s README for its current container invocation and deployment instructions; do not assume the Go command’s flags or runtime setup transfer unchanged to another Go proxy.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Restrict which destinations the proxy can reach
The README documents -allowedTargets and says private network targets are disallowed by default. It gives this allowlist example:
corsproxy -allowedTargets "https://*.example.com,https://ipinfo.io"Replace the example domains with the specific API hosts your application needs. An allowlist is a meaningful safety control: it narrows the proxy’s outbound destinations instead of letting callers choose arbitrary hosts. Private-network blocking is also important because a proxy exposed to untrusted callers could otherwise become a route to services that should not be reachable from the public internet. Verify the exact matching behavior and any relevant edge cases in the selected project’s README before relying on the restriction in production.
Make a request through localhost
The project README shows this example request URL:
http://localhost:8000/https://ipinfo.io/jsonThe URL places the destination after the proxy’s local address and path. A browser application can request the proxy URL instead of requesting the third-party endpoint directly, provided the proxy is running and its CORS settings permit the browser origin. The README points to rs/cors for CORS-related options; use that library’s documentation for the configuration supported by this project.
How it differs from CORS Anywhere
CORS Anywhere is a Node.js reverse proxy. Its README describes a request path in which the target URL is taken from the request path, and advises operators of heavily used instances to whitelist their own site so others cannot use the instance as an open proxy. The Go project also demonstrates a destination embedded in the request URL, and documents private-target blocking and an allowlist flag. Those documented similarities do not establish complete feature parity.
Rank #4
| Area | zachcheung/corsproxy | CORS Anywhere |
|---|---|---|
| Runtime | Go project; README documents Go installation and a Docker image. | Node.js reverse proxy. |
| Request shape | README example: http://localhost:8000/https://ipinfo.io/json. |
README says the target URL is taken from the request path. |
| Destination controls | README says private network targets are disallowed by default and documents -allowedTargets. |
README advises whitelisting the operator’s site on a heavily used instance to prevent open-proxy use. |
| Credentials, cookies, and headers | Not established by the cited README details here; check the selected project’s documentation before depending on specific forwarding behavior. | Configuration and request behavior are documented in its README; check that documentation for the exact behavior required. |
| Authentication and rate limiting | Do not assume these controls are provided: verify them in the selected project’s documentation or implement appropriate controls at the deployment layer. | Do not assume these controls are provided: verify the project’s current documentation and deployment setup. |
A separate Go option is documented by the fourfs/corsproxy package documentation as a zero-dependency Go version of CORS Anywhere. It is a different repository from zachcheung/corsproxy. Do not substitute one project’s installation commands, flags, or behavior for another’s.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Before making a proxy public
A local development proxy and a public service have different risk profiles. If anyone can send requests through your deployed instance, you need to control both who can use it and where it can connect. An unrestricted public proxy can be abused for unwanted traffic or attempts to reach internal services.
Best Value
- Limit destinations: Configure
-allowedTargetsfor the API hosts your application needs, and preserve the default private-network restriction. - Limit inbound users: Decide which sites or clients may use the service. CORS headers govern browser access; they are not authentication and do not stop non-browser clients from contacting a public endpoint.
- Add operational controls: The README for another Go proxy lists API keys and rate limiting among production considerations. Treat those as controls to evaluate for your deployment, not as features guaranteed by zachcheung/corsproxy.
- Review credentialed CORS carefully: The rs/cors documentation notes a safeguard involving wildcard
AllowedOriginswithAllowCredentials. Avoid broad credentialed-origin configurations and follow the library’s guidance.
The zachcheung project README documents target restrictions, but that alone does not establish inbound authentication or rate limiting. Confirm how the exact version you deploy handles destinations, users, and credentials before exposing it beyond a trusted development environment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
