How to Test CORS Locally in Chrome

Updated October 2026 · v1.2.0

CORS is enforced by the browser, using response headers from the server. A missing Access-Control-Allow-Origin on an API response is a server configuration problem.

HeaderSwap can add that response header locally so you can see whether the rest of the app works. The override disappears for anyone who does not run your profile. Ship the real header on the API before you call it fixed.

Get HeaderSwap for Chrome

Confirm the failure without an extension

Do this first so you know you are looking at CORS and not a 401 or a network error.

Reproduce in DevTools. Trigger the request. A CORS failure is reported in the console and the response is hidden from the page.
Read the response headers. If the server omits Access-Control-Allow-Origin, or omits the method you used, the browser is following the spec.
Fix the API when you own it. Add the header on the server for the origin you actually use. A browser extension is not that fix.

Unblock only your browser while you debug

The Allow CORS preset writes the response headers in this Chrome profile. Turn it off before you demo on a machine that should see the real server.

Limit the rule to the API host. Do not apply Allow CORS to every site. Restrict the profile to the origin you are calling.
Apply the Allow CORS preset. Reload the app and confirm the console error is gone.
Remove the rule. Pause the profile and reload. The error should return until the server sends the header itself.

A local pass is not production

Customers will still fail if the API does not send the header.
Credentialed requests need the specific origin, not *, plus Access-Control-Allow-Credentials. A sloppy preset can hide that mistake.
HeaderSwap does not read the response body. It only changes headers it is allowed to modify.

Frequently Asked Questions

Will Allow CORS fix the bug for my users?

No. It changes headers in your browser. Users need the API to send the headers.

Does this work for a request that never leaves the browser?

CORS applies to the cross-origin response the browser receives. If the request is blocked before that, read the status code first.

Is the preset free?

Presets, including Allow CORS, are on the free plan, within the free rule and profile caps.