CORS proxy

A CORS proxy is a small server-side intermediary that forwards a browser's request to an upstream API and returns the response with the right Access-Control-Allow-Origin header attached. The proxy is still a different origin from your page, but because its response carries that header, the browser's CORS check passes and your code can read it.

Need one now? corsproxy.dev is a managed CORS proxy: get a free key (500 requests/day, no card) and follow the quickstart.

What it actually does

1. Receives a request like GET /proxy?url=https://api.example.com/data.
2. Issues that request server-to-server (which doesn't trigger CORS, because CORS is enforced only by browsers).
3. Returns the upstream response, but with Access-Control-Allow-Origin: * (or a specific origin) added.

The request to the proxy is still cross-origin. The browser allows your code to read the response because the proxy sends Access-Control-Allow-Origin, which the upstream did not.

When you'd use one

• Calling a third-party API that doesn't send CORS headers and you can't change.
• Development against an upstream that doesn't allowlist localhost.
• Prototypes and demos where adding a backend just to relay one request is overkill.
• Browser extensions and tools that need to fetch arbitrary URLs.

When you'd avoid one

• If you control the upstream, configure CORS on it instead. That's the correct fix.
• If the data is sensitive enough that you don't want a third party to see the URLs (or the URLs are the secret, e.g. signed asset URLs).
• If the upstream needs authentication and you were planning to send the browser's own credentials. Careful proxies strip the browser's Authorization and Cookie headers so they are not relayed to an arbitrary target. The safer pattern is for the proxy to inject a secret stored server-side; corsproxy.dev does this with managed upstream headers, so the API secret never ships to the browser.

The security gotchas

A naive open CORS proxy is a textbook SSRF tool: anyone can ask it to fetch http://169.254.169.254/latest/meta-data/ and read AWS credentials, or http://10.0.0.5/ and probe internal networks. Production-grade proxies block private-IP targets, refuse non-HTTP schemes, strip dangerous headers, and rate-limit by API key. See our security writeup for the full threat model.

Example

// Direct call: blocked by CORS
fetch('https://api.example.com/data')
  .then(r => r.json())
  // → TypeError: blocked by CORS policy

// Through a CORS proxy: works
fetch('https://api.corsproxy.dev/proxy?url=' +
      encodeURIComponent('https://api.example.com/data'), {
  headers: { 'X-API-Key': 'sk_live_...' }
})
  .then(r => r.json())
  // → { …actual data… }