Preflight request
Paste the request headers (or the raw OPTIONS request). You may include the request line and status lines — they are ignored.
Response headers
Paste the server's Access-Control-Allow-* headers. Adding the response line (e.g. HTTP/1.1 204) also checks the preflight status.
Paste a preflight request and response to run the checks.
Checks
Explained headers
Server policy
Wildcard origin cannot be combined with credentials — browsers reject that combination. The generator refuses it and emits a warning line.