Free CORS Policy Checker

Nginx

map $http_origin $cors_origin {
    default "";
    "https://app.example.com" $http_origin;
}

server {
    location /api/ {
        # Preflight. Headers are repeated here because nginx "if"
        # blocks do not inherit add_header from the surrounding scope.
        if ($request_method = OPTIONS) {
            add_header Access-Control-Allow-Origin $cors_origin always;
            add_header Access-Control-Allow-Credentials "true" always;
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
            add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
            add_header Access-Control-Max-Age 600 always;
            add_header Vary "Origin" always;
            return 204;
        }

        # Actual responses. nginx omits an add_header whose value is
        # empty, so a non-allowlisted origin (empty $cors_origin) gets
        # no Access-Control-Allow-Origin header at all.
        add_header Access-Control-Allow-Origin $cors_origin always;
        add_header Access-Control-Allow-Credentials "true" always;
        add_header Vary "Origin" always;
    }
}

Apache

<IfModule mod_headers.c>
    SetEnvIf Origin "^https://app\.example\.com$" CORS_ORIGIN=$0
    Header always set Access-Control-Allow-Origin "%{CORS_ORIGIN}e" env=CORS_ORIGIN
    Header always set Access-Control-Allow-Credentials "true" env=CORS_ORIGIN
    Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS" env=CORS_ORIGIN
    Header always set Access-Control-Allow-Headers "Authorization, Content-Type" env=CORS_ORIGIN
    Header always set Vary "Origin"
</IfModule>

RewriteEngine On
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=204,L]

Node.js (Express + cors)

import express from "express"
import cors from "cors"

const allowedOrigins = ["https://app.example.com"]

const app = express()

app.use(
  cors({
    origin: (origin, cb) => {
      if (!origin || allowedOrigins.includes(origin)) return cb(null, true)
      return cb(new Error("Not allowed by CORS"))
    },
    credentials: true,
    methods: ["GET", "POST", "OPTIONS"],
    allowedHeaders: ["Authorization", "Content-Type"],
    maxAge: 600,
  }),
)