CORS Header Generator

Allow every origin · GET, HEAD, OPTIONS · Max-Age 600 · the server answers the preflight · nginx

# CORS — nginx (ngx_http_headers_module + ngx_http_map_module).
# Place this location inside the server block it applies to.
location /api/ {
    add_header Access-Control-Allow-Origin "*" always;
    add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
    add_header Access-Control-Max-Age "600" always;

    if ($request_method = OPTIONS) {
        return 204;
    }
}

The read-only public API. Nothing is echoed, so no map block and no Vary are warranted, and the OPTIONS branch holds return 204 alone.

Allow https://app.example.com · GET, POST, OPTIONS · Authorization and Content-Type · expose X-Request-Id · credentials on · Apache

# CORS — Apache 2.4 (mod_headers, mod_setenvif, mod_rewrite).
# Place inside the <Directory>, <Location> or virtual host it applies to.
<IfModule mod_setenvif.c>
    SetEnvIf Origin "^(https://app\.example\.com)$" CORS_ALLOW_ORIGIN=$1
</IfModule>
<IfModule mod_headers.c>
    Header always set Access-Control-Allow-Origin "%{CORS_ALLOW_ORIGIN}e" env=CORS_ALLOW_ORIGIN
    Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
    Header always set Access-Control-Allow-Headers "Authorization, Content-Type"
    Header always set Access-Control-Expose-Headers "X-Request-Id"
    Header always set Access-Control-Allow-Credentials "true"
    Header always set Access-Control-Max-Age "600"
    Header always set Vary "Origin"
</IfModule>
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} =OPTIONS
    RewriteRule ^ - [R=204,L]
</IfModule>

The signed-in shape. SetEnvIf captures the matching origin into an environment variable and mod_headers writes it back, which is how one value is chosen per request. Checked with httpd -t against Apache 2.4.66.

Allow https://a.example, https://b.example, http://localhost:3000 · GET · the application answers OPTIONS itself · Express

// CORS — Express. Register this before your routes and before any
// authentication middleware: a preflight OPTIONS carries no credentials.
const ALLOWED_ORIGINS = new Set([
  "https://a.example",
  "https://b.example",
  "http://localhost:3000",
]);

app.use((req, res, next) => {
  const origin = req.headers.origin;
  if (typeof origin === "string" && ALLOWED_ORIGINS.has(origin)) {
    res.setHeader("Access-Control-Allow-Origin", origin);
  }
  res.setHeader("Access-Control-Allow-Methods", "GET");
  res.setHeader("Vary", "Origin");
  next();
});

Three origins, a development port among them. The short-circuit is off, so the middleware falls through to next() and your own OPTIONS route replies; turn it on and four lines answering 204 take the place of that fall-through.

Allow every origin · GET, POST · request headers * · expose * · server answers the preflight · Caddy

# CORS — Caddy 2 (Caddyfile). Place inside the site block it applies to.
header {
	Access-Control-Allow-Origin "*"
	Access-Control-Allow-Methods "GET, POST"
	Access-Control-Allow-Headers "*"
	Access-Control-Expose-Headers "*"
}

@cors_preflight method OPTIONS
respond @cors_preflight 204

Caddyfile indentation is tabs, reproduced as emitted. Both lists are stars, which is legal and narrower than it looks: the star never covers Authorization, and means nothing at all once credentials are on.

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST
Vary: Origin

Access-Control-Allow-Origin: *
Any origin may read this response, and only when the request was sent without credentials — a browser refuses * the moment cookies or an Authorization header are attached.

Access-Control-Allow-Methods: GET, POST
A preflight asking for GET, POST is allowed. Any other method is refused, and this field is read only during the OPTIONS preflight.

Access-Control-Allow-Credentials: true
Cookies and Authorization headers are allowed on these requests, and the response is readable with them attached. This only works alongside an exact origin — never alongside *.

Vary: Origin
This response is cached per the listed request fields. With Origin in the list, a shared cache keeps the per-origin answers apart instead of serving the first caller's Access-Control-Allow-Origin to everybody.

Explain mode, reading a deployment back. The status line stays out of the field list, each field gets its own sentence, and the clash between lines one and three is reported separately.

Edge case · allow every origin · credentials on · Authorization listed · Max-Age 600 · nginx

H_CORS_WILDCARD_WITH_CREDENTIALS
A credentialed request cannot read a response whose Access-Control-Allow-Origin is *. Echo the request's Origin instead, and add Vary: Origin so caches keep the answers apart (WHATWG Fetch, CORS protocol).

E1_CORS_CREDENTIALS_WILDCARD
Nothing was emitted for nginx, Apache, Express or Caddy: no way of writing this pair in a configuration file makes it work. Switch the origin to an explicit allow-list, or turn credentials off.

The one combination this page will not write out: the file would load cleanly and fail every credentialed call. No block is produced for any of the four servers, and the reason is printed instead.