CORS Config Validator

A CORS setup that refuses to work is usually a typo rather than a misunderstanding: a stray trailing slash, a missing scheme, the same origin pasted twice into the array. This page takes a comma-separated list of allowed origins and returns a single verdict, valid or invalid, updated as you type, so you can catch the typo before it reaches staging.

The rules are strict and worth knowing. A lone asterisk passes. Otherwise every item needs an http or https scheme, a host, an optional port and nothing else — no path, no trailing slash, no duplicates anywhere in the list. That is why https://app.com/ fails: the Origin header never carries a path. And https://*.app.com fails too, because subdomain wildcards are not valid in Access-Control-Allow-Origin.

Read this as a format check, not a security review. A lone asterisk comes back valid even though browsers reject it whenever Access-Control-Allow-Credentials is on — which is the classic mistake. Plain http:// origins also pass, hostnames with underscores are accepted, and bracketed IPv6 addresses are rejected. The verdict covers the whole list at once and does not point at the offending item. Everything runs in the browser.