Free CORS Policy Checker

Nginx

map $http_origin $cors_origin {
    default "";
    "https://app.example.com" $http_origin;
}

server {
    location /api/ {
        if ($cors_origin) {
            add_header Access-Control-Allow-Origin $cors_origin always;
            add_header Access-Control-Allow-Credentials "true" always;
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
            add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
            add_header Vary "Origin" always;
        }
        if ($request_method = OPTIONS) {
            add_header Access-Control-Max-Age 600;
            return 204;
        }
    }
}

Apache

<IfModule mod_headers.c>
    SetEnvIf Origin "^https://app\.example\.com$" CORS_ORIGIN=$0
    Header always set Access-Control-Allow-Origin "%{CORS_ORIGIN}e" env=CORS_ORIGIN
    Header always set Access-Control-Allow-Credentials "true" env=CORS_ORIGIN
    Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS" env=CORS_ORIGIN
    Header always set Access-Control-Allow-Headers "Authorization, Content-Type" env=CORS_ORIGIN
    Header always set Vary "Origin"
</IfModule>

RewriteEngine On
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=204,L]

Node.js (Express + cors)

import express from "express"
import cors from "cors"

const allowedOrigins = ["https://app.example.com"]

const app = express()

app.use(
  cors({
    origin: (origin, cb) => {
      if (!origin || allowedOrigins.includes(origin)) return cb(null, true)
      return cb(new Error("Not allowed by CORS"))
    },
    credentials: true,
    methods: ["GET", "POST", "OPTIONS"],
    allowedHeaders: ["Authorization", "Content-Type"],
    maxAge: 600,
  }),
)