Can I use * and credentials together?

No. The fetch spec rejects responses that pair Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true. Either drop credentials, or echo the actual request Origin server-side after validating it against an allow-list.

Why the Vary: Origin recommendation?

If you echo Origin into Allow-Origin, downstream caches must vary their stored response on the request's Origin header; otherwise they may serve one site's CORS response to another site's request. Vary: Origin tells caches to key on that header.

CORS Headers Builder

Builds the response headers a server needs to send to satisfy a browser's cross-origin request. Includes Allow-Origin, Allow-Methods, Allow-Headers, Expose-Headers, Allow-Credentials, Max-Age, and a Vary: Origin hint. Flags the common foot-guns: combining * with credentials (browsers will block it), accepting Origin: null (an attacker can spoof it), or asking the browser to cache the preflight for unreasonably long.

—

Presets

Allow-OriginUse * for public assets, a specific URL for trusted callers, or echo the request's Origin server-side.

Allow-Methods

Allow-HeadersHeaders the browser may send. * works only without credentials.Expose-HeadersResponse headers the browser exposes to JS beyond the safelist.

Allow-CredentialsVary: OriginMax-Age (s)

Response headers

Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 600
Vary: Origin

Apply these on the response to preflight OPTIONS *and* the actual request. Edge caches need Vary: Origin if you echo Origin.

How to use

Start from a preset that matches your scenario.
Set the origin (* for fully-public, or echo the request's Origin server-side for credentialed APIs).
Pick the methods and headers your endpoint actually accepts — narrower is safer.
Copy the headers into your server, edge worker, or framework middleware.

Frequently asked questions

Can I use * and credentials together?: No. The fetch spec rejects responses that pair Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true. Either drop credentials, or echo the actual request Origin server-side after validating it against an allow-list.
Why the Vary: Origin recommendation?: If you echo Origin into Allow-Origin, downstream caches must vary their stored response on the request's Origin header; otherwise they may serve one site's CORS response to another site's request. Vary: Origin tells caches to key on that header.

Related tools

HTTP Headers Reference

Searchable reference for ~50 standard HTTP request, response, CORS, caching, security, and cookie headers.

Developer 0 0

Referrer-Policy Header Builder

Pick a Referrer-Policy value and see exactly what `Referer` header outbound requests will send — same-origin, cross-origin HTTPS, HTTPS→HTTP downgrade.

Network 0 0

Cache-Control Header Builder

Build an HTTP Cache-Control header from a visual checklist — freshness, revalidation, immutability, and the common presets.

Network 0 0

robots.txt Tester

Paste a robots.txt and a list of (user-agent, path) pairs to see exactly which line allows or blocks each — with longest-match precedence, wildcards, and the * group fallback.

Network 0 0

HTTP Basic Auth Encoder / Decoder

Encode `username:password` into the Base64 `Authorization: Basic` header — or paste an existing header back to see who's in it.

Network 0 0

URL Query Builder

Build URLs by combining a base address with editable key-value query parameters — each pair toggleable, properly percent-encoded.

Network 0 0