You know the fix, not the syntax
You have diagnosed a CORS error and know which origin and methods to allow — but you do not remember the exact Nginx add_header block or the Apache mod_headers syntax, and you keep getting the credentials rule wrong.
Generate it
Open the CORS Header Generator: enter the Allow-Origin, toggle methods, list Allow-Headers, set Max-Age, and choose credentials. It emits a Nginx block, an Apache block, and a matching fetch() example you can paste straight in.
Worked example
Origin https://app.example.com, methods GET/POST, headers Content-Type, Authorization, Max-Age 600, credentials off → a clean Nginx location /api/ block with an OPTIONS → 204 preflight handler.
Boundaries
- If Allow-Credentials is on, the generator keeps Allow-Origin as your exact origin (not
*), which the spec requires. - The snippet is a starting point — adapt to your server version and existing config.
FAQ
Why the OPTIONS handler? Browsers send a preflight OPTIONS request for non-simple requests; it must return 204 with the CORS headers.
Still blocked after deploying? Re-run the CORS Diagnostic with the new console error.