CORS Unblocker

Fix CORS errors while you develop: see which calls are blocked, then relax CORS headers only for the pages you trust.

CORS Unblocker is a development tool for web developers whose app calls APIs on other origins (a local frontend calling a staging API, for example) and runs into CORS errors. SEE WHAT'S BLOCKED - A red number on the toolbar icon counts the calls on the current tab that failed CORS, even while the extension is switched off. • The popup and the DevTools "CORS" panel list each blocked call with the reason: a missing or mismatched Access-Control-Allow-Origin header, a preflight that rejects your method or headers, or a call that sends cookies to a server answering "*". FIX IT IN ONE CLICK - "Fix" unblocks exactly the blocked calls, only from the page that made them, so some requests are relaxed and others keep normal CORS. It shows what it will change before you click. • Problems no header can fix, such as a preflight answered with 404, are explained instead of hidden. ONLY THE PAGES YOU TRUST - Unblock one call at a time, or trust the whole page you're developing (localhost:3000, say). Every other website keeps normal CORS. • Responses that already carry CORS headers are left alone by default, so APIs that handle CORS themselves, including ones that use cookies, keep working. • Skip rules, per-rule methods, exposed response headers and credentials support are available in Settings. SAFE BY DEFAULT - Off until you turn it on. The toolbar icon is greyed out while it's off. • "Pause 1 hour" switches overrides off and back on by itself. • Nothing leaves your browser: no accounts, analytics or servers. Privacy policy: https://github.com/nevin/cors-unblocker/blob/main/PRIVACY.md Open source (GPL-3.0): https://github.com/nevin/cors-unblocker