AllOrigins alternative: replacing api.allorigins.win
api.allorigins.win is free, open source, and unreliable today. Options to replace it, how /get and /raw map to other proxies, and the code change for each.
corsproxy.io not working? 401, 403, and what changed
corsproxy.io now requires an API key on every request, and free keys only work from development origins. How to tell a 401 from a 403 and what to do about each.
SSRF IP obfuscation: what gets past a CORS proxy
Decimal, octal, hex, and IPv6-mapped forms of an address are the classic SSRF bypass tricks. We ran each through the URL parser to see what hostname actually reaches a CORS proxy's address filter.
CORSflare, read from the source
We read the CORSflare.js source behind this open-source Cloudflare Worker CORS proxy: a response header conflict browsers reject outright, and preflight requests that reach the configured upstream untouched instead of getting a direct answer.
Access-Control-Expose-Headers, explained
A custom response header shows up in DevTools but fetch() still returns null for it. We tested the fix in a real browser, with and without the header, including the wildcard-plus-credentials exception, and checked it against corsproxy.dev's own proxy responses.
CORS in Flask: flask-cors and the credentials trap
Flask sends no CORS headers on its own. We tested flask-cors 6.0.5's defaults and found that supports_credentials=True, left next to the untouched default origin, reflects any site's Origin header with credentials allowed.
CORS in Fastify: setting up @fastify/cors
Fastify sends no CORS headers on its own. We tested @fastify/cors against Fastify 5.12.7 and found a registration-order bug: an auth hook added before the plugin silently blocks the preflight, which shows up to the browser as a CORS error instead of a 401.
Cloudflare Workers limits for a CORS proxy
CPU time doesn't count the wait on an upstream, a proxied call can cost up to three subrequests, and 128 MB of isolate memory is shared across every concurrent request. What each Workers limit covers, and where corsproxy.dev's own request pattern sits under it.
Server-Sent Events and CORS: EventSource's limits
EventSource has no headers option and its only cross-origin setting is withCredentials, so the fixes that work for fetch often don't apply. What withCredentials actually controls, how to authenticate it against corsproxy.dev, and why a buffering proxy still can't make it stream live.
CORS in Go: net/http, Gin, and Chi
net/http sends no CORS headers on its own: a preflight gets a clean 200 with nothing CORS-specific attached. We tested a hand-rolled middleware against gin-contrib/cors 1.7.9 and go-chi/cors 1.2.2, plus the wildcard-and-credentials mistake that breaks all three the same way.
Caching API responses with the ttl parameter
On Pro and Enterprise, ttl caches a successful GET response at the Cloudflare data center that served it. What goes into the cache key, what X-Cache means, and why a hit still counts against your daily quota.
Why CORS proxies don't follow redirects for you
corsproxy.dev passes a target's 3xx straight through instead of following it, which can make fetch() fail right after the proxy call succeeds. Why that's a safety choice, how the open-source relay differs, and how to work around it.
The Sec-Fetch-Site header, and what breaks it
Browsers attach Sec-Fetch-Site to every request and scripts can't override it. We checked what our own proxy does with it on the way to an upstream API, and why the value that arrives stops meaning what the receiving server assumes.
Cloudflare's CORS proxy Worker, benchmarked against corsproxy
Same Docker network, same upstream, same load tool. corsproxy did 7 to 9x the throughput of the example Worker on workerd, and five of seven security probes went one way. Every command is in the post.
How to allow CORS on any server
The same four headers written out for Nginx, Apache, Go, Spring Boot, Cloudflare Workers, Netlify and Vercel, a curl command that proves the preflight works, and the three mistakes that keep the error alive.
cloudflare-cors-anywhere, read from the source
We read the index.js behind the most-forked self-hosted Cloudflare Workers CORS proxy: a wide-open origin check, Authorization and Cookie forwarded with no target restriction, and a printed rate limit the code never enforces.
Fixing the Access-Control-Allow-Headers error
A custom header gets rejected during preflight before your real request ever goes out. What the error means, the Authorization exception to the wildcard, and how to fix it on either end.
Why CORS doesn't apply to WebSockets
A WebSocket handshake never sends a CORS preflight, so adding Access-Control-Allow-Origin to your server does nothing for a failed connection. What gates a WebSocket instead, and how to check and restrict origins yourself.
Null origin in CORS: why you can't trust it
Origin: null comes from sandboxed iframes and file:// pages, and any attacker can trigger it on demand. Why allowlisting it in a CORS response is a known vulnerability, not a workaround.
api.codetabs.com proxy is down: what to do
The codetabs CORS proxy was switched off in June 2026 after an abuse suspension and still returns an error. How to confirm it from your terminal and how to pick a replacement that lasts.
CORS in Django: setting up django-cors-headers
Django sends no CORS headers on its own, and a middleware in the wrong spot breaks it silently on redirects. Tested against Django 5.2 and django-cors-headers 4.9.0.
CORS in Next.js 16: Route Handlers and proxy.ts
Next.js doesn't send CORS headers for you, and its default OPTIONS response isn't enough on its own. Tested against Next.js 16.3, including the middleware.ts → proxy.ts rename that breaks older tutorials.
Cloudflare KV vs D1 vs Durable Objects, in production
corsproxy.dev uses all three Cloudflare storage primitives at once, for different pieces of the same request. Why each one earns its place, the rule of thumb we use to pick between them, and why the Workers Rate Limiting binding doesn't replace any of them.
CORS proxy cookie forwarding: what we fixed
A CORS proxy that blindly relays your Cookie header to whatever target you give it can leak a session cookie to the wrong domain. The fix, and how to check your own proxy.
corsproxy.dev vs cors.sh: a side-by-side comparison
Two Cloudflare-edge CORS proxies compared, using cors.sh's own committed spec: free allowance, limits, SSRF handling, and where cors.sh is ahead.
When not to use a CORS proxy
A CORS proxy fixes one specific problem: a response missing Access-Control-Allow-Origin. Six situations where reaching for one is the wrong move, and what to do instead.
CORS preflight caching: how Access-Control-Max-Age works
Access-Control-Max-Age tells the browser how long to skip the OPTIONS preflight, but each browser caps it at its own ceiling and a changed request resets the cache anyway.
An MCP server for safe API calls from AI agents
Give Claude Code, Cursor, or your own agent HTTP access that keeps API secrets out of the model, blocks internal addresses, and stops at a quota.
corsproxy.io alternative: corsproxy.dev compared
Similar names, different strengths. Free tiers, pricing, uptime, secret handling, and open source side by side, including where corsproxy.io is ahead.
CSP vs CORS: why your fetch is blocked
Content-Security-Policy and CORS block requests for different reasons and throw different console errors. How to tell them apart from the message text and fix each one.
Do you need a CORS proxy in React Native or Expo?
Native fetch isn't subject to CORS at all, but Expo Web, RN Web, and WebView screens run in a real browser and are. How to tell which one you're hitting.
CORS proxy for Webflow, Framer, and Bubble custom code
Custom code embeds run in the visitor's browser, so they hit CORS the same way any frontend does. Copy-paste fixes for all three, no backend required.
Call OpenAI, Notion, and Google Sheets from the browser without leaking your API key
CORS isn't what stops you, the secret key is. Keep it out of client-side JavaScript without writing a backend, and know what that still can't protect.
Rate limits and quotas on corsproxy.dev, explained
What counts against your daily quota, why you got a 429, when the counter resets, and how it's enforced atomically instead of eventually.
Blocking a country's traffic with Cloudflare WAF (without blocking everyone)
One country was 96% of our traffic and almost none of it real. The WAF rule that stopped it, the expression mistakes that block everyone or no one, and how to check it works.
Free CORS proxy: 7 options compared in 2026
cors-anywhere, allorigins, ThingProxy, corsproxy.io, and corsproxy.dev. Which ones are still maintained, what to check before you pick one, and what to do when your current proxy starts returning 429s.
CORS with cookies and credentials: the rules that bite
Your login sets a cookie but the next request comes back logged out. The four moving parts that all have to align, with code and the most common failures.
How to enable CORS in Node.js and Express
The one-line dev fix, the production-ready allowlist, the per-route configuration, and the common gotchas, with copy-paste code.
cors-anywhere alternative: migrate to corsproxy.dev
The public cors-anywhere.herokuapp.com demo is opt-in and rate-limited. The migration path, what changes in the request, and code for fetch, Axios, and helper wrappers.
Self-host vs managed CORS proxy: which one for which job?
A managed proxy with keys and quotas, or a simpler open-source relay you run yourself. How they differ in behaviour, cost and security, and when each one fits.
5 ways to fix CORS in development
Server-side CORS, Next.js rewrites, a CORS proxy, the Vite dev proxy, and a flag-disabled browser. Five practical fixes, ordered by how production-safe each one is.
How a CORS proxy works — and how it can be abused
CORS proxies are powerful and, by default, dangerous. How an open relay gets abused, what corsproxy.dev does about each threat, and where those defences stop.
Why am I getting a CORS error?
The browser console says "blocked by CORS policy". What that means, why it happens, how to tell it apart from mixed content, and three ways to fix it, with code.
Frequently asked questions
Logging policy, GDPR posture, authentication header forwarding, self-hosting options, and other things people email us about.