CORS Cheat Sheet

Understand and troubleshoot Cross-Origin Resource Sharing policies, headers, and browser preflight behavior for APIs and web apps.

What this cheat sheet is for

This cors reference helps you complete common developer tasks quickly and avoid repeated trial-and-error when working under deadlines.

When you need a reliable command or pattern during debugging and incident response.
When you are implementing a feature and want a known-good syntax example immediately.
When onboarding teammates and documenting repeatable workflows for daily use.
When reviewing pull requests and verifying that command usage follows best practices.

Core CORS Response Headers

Use these headers to control which origins, methods, and request headers are allowed.

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true

Example (Express.js)

app.use((req, res, next) => {
  res.setHeader('Access-Control-Allow-Origin', 'https://app.example.com');
  res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE,OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
  next();
});

Preflight (OPTIONS) Requests

Browsers send an OPTIONS request before certain cross-origin requests.

OPTIONS /api/orders HTTP/1.1
Origin: https://app.example.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization, content-type

Example Preflight Response

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Max-Age: 600

Common CORS Debugging Checks

Verify request origin, credentials mode, and exact header values in browser devtools.

# Inspect response headers quickly
curl -i https://api.example.com/data -H "Origin: https://app.example.com"

Common mistakes / Pitfalls

People often copy a command or pattern without adapting placeholders, which can break production workflows unexpectedly.
It is easy to forget environment-specific differences, so always verify behavior in your shell, runtime, or API gateway before shipping.
Many errors come from skipping small validation steps, so test with realistic sample input before relying on the result.

Last updated: February 2026