All Tools/Security & HeadersEssential

CORS Header Tester & Preflight Simulator

Troubleshoot CORS failures by testing custom origins, HTTP methods, authorization headers, and cookies against real or simulated API endpoints.

RazeQA Synergy: Fix 403 / CORS preflight errors in test network logs by exporting copy-paste Express/Next.js middleware.

Run Automated Journey Test

Live Preflight OPTIONS ProbeLive HTTP

Target Calling Origin (Origin header)

Simulated HTTP Method

Allowed Headers (Access-Control-Allow-Headers)

Allow Credentials (Cookies, Authorization tokens)

Next.js Middleware / Config snippet

// Next.js (next.config.js) Headers
module.exports = {
  async headers() {
    return [
      {
        source: '/api/:path*',
        headers: [
          { key: 'Access-Control-Allow-Origin', value: 'https://dashboard.example.com' },
          { key: 'Access-Control-Allow-Methods', value: 'GET,POST,PUT,DELETE,OPTIONS' },
          { key: 'Access-Control-Allow-Headers', value: 'Content-Type, Authorization, X-Request-ID' },
          { key: 'Access-Control-Allow-Credentials', value: 'true' },
        ],
      },
    ];
  },
};

Express / Node.js CORS snippet

// Express.js CORS Configuration
const cors = require('cors');

app.use(cors({
  origin: 'https://dashboard.example.com',
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization', 'X-Request-ID'],
  credentials: true,
}));