CORS basics

Browsers enforce the same-origin policy: JavaScript on one origin generally cannot read responses from another origin unless the server opts in with CORS response headers.

Key response headers

• Access-Control-Allow-Origin (ACAO) — which Origin may read the response (* or an explicit origin).
• Access-Control-Allow-Credentials (ACAC) — whether cookies / Authorization may be included (true only; cannot pair with ACAO *).
• Access-Control-Expose-Headers (ACEH) — which non-safelisted response headers JS may read.
• Vary — often should include Origin when ACAO echoes the request Origin (cache correctness).

What CORSProbe does

It fetches a public URL (with an optional Origin request header), shows the Access-Control-* headers that came back, and explains mismatches in plain language. It does not run in your browser’s network stack, so it is an educational approximation — not a substitute for DevTools.

Probe a URL