{"slug":"cors-header-checker-underscoredone-com-check-7ee69a","title":"Sends a real request to any URL you provide, attaches an Origin header, and read","host":"cors-header-checker.underscoredone.com","method":"POST","resource":"https://cors-header-checker.underscoredone.com/check","category":"other","description":"Sends a real request to any URL you provide, attaches an Origin header, and reads back all six standard cross-origin permission headers the server returns. Tells you whether cross-origin requests are enabled at all, whether your specific origin is permitted, and shows every permission value exactly ","price_listed":0.01,"price_asked":null,"state":"effects","state_label":"Not tested: has real-world effects","checks_7d":0,"answered_7d":0,"latency_ms_median":null,"reported_calls_30d":3,"reported_payers_30d":3,"networks":["eip155:8453","solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"body":{"origin":"https://myapp.com","url":"https://api.github.com"},"bodyType":"json","method":"POST","type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"additionalProperties":false,"properties":{"origin":{"description":"The website address you want to test cross-origin access from, for example https://myapp.com. Defaults to https://example.com if you leave it out.","type":"string"},"url":{"description":"The full web address of the endpoint you want to check — must start with http:// or https://.","type":"string"}},"required":["url"],"type":"object"},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST","PUT","PATCH"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"},"output":{"properties":{"example":{"properties":{"api_version":{"type":"string"},"cors_enabled":{"type":"boolean"},"error":{"type":"string"},"headers":{"additionalProperties":true,"type":"object"},"origin_allowed":{"type":"boolean"},"origin_tested":{"type":"string"},"status":{"type":"integer"},"url":{"type":"string"}},"required":["api_version","url","origin_tested","status","cors_enabled","origin_allowed","headers","error"],"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"},"history":[],"description_full":"Sends a real request to any URL you provide, attaches an Origin header, and reads back all six standard cross-origin permission headers the server returns. Tells you whether cross-origin requests are enabled at all, whether your specific origin is permitted, and shows every permission value exactly as the server sent it. Useful for finding why a browser is blocking a request, confirming a new deployment is configured correctly, or auditing whether a public API allows credentialed calls.","last_updated":"2026-09-14T19:48:35.525Z","schemes":["exact"]}