How do I debug CORS and security headers?
Short answer: Capture the exact response headers for the failing request, then check origin, credentials, allowed methods, CSP, cookie flags, and caching rules together.
Steps
- Paste the response headers from the failing browser request.
- Check Access-Control-Allow-Origin, credentials, methods, and preflight behavior.
- Inspect CSP, HSTS, X-Content-Type-Options, frame protection, and referrer policy.
- Review Set-Cookie flags such as Secure, HttpOnly, SameSite, Domain, Path, and expiry.
Use debugtools
Open the Security Headers + CORS Inspector to run this workflow in the browser.
Related tools
CSP ParserCookie Security InspectorAPI Workbench