corsproxy.dev
Working notes from the team behind corsproxy.dev. Plain-English explanations and honest tradeoffs.
Next.js doesn't send CORS headers for you, and its default OPTIONS response isn't enough on its own. Tested against Next.js 16.3, including the middleware.ts → proxy.ts rename that breaks older tutorials.
corsproxy.dev uses all three Cloudflare storage primitives at once, for different pieces of the same request. Why each one earns its place, and the rule of thumb we use to pick between them.
A CORS proxy that blindly relays your Cookie header to whatever target you give it can leak a session cookie to the wrong domain. The fix, and how to check your own proxy.
Two Cloudflare-edge CORS proxies, both with public source — so this one has receipts, not just marketing copy. Where cors.sh is ahead, where it isn't, straight from their own committed spec.
A CORS proxy fixes one specific problem: a response missing Access-Control-Allow-Origin. Six situations where reaching for one is the wrong move, and what to do instead.
Access-Control-Max-Age tells the browser how long to skip the OPTIONS preflight — but Chrome, Firefox, and Safari each cap it at a different ceiling, and a changed header resets the cache anyway.
Give Claude Code, Cursor, or your own agent HTTP access that keeps API secrets out of the model, blocks internal addresses, and stops at a quota.
Similar names, different strengths. Free tiers, pricing, uptime, secret handling, and open source side by side, including where corsproxy.io is ahead.
Content-Security-Policy and CORS block requests for different reasons and throw different console errors. How to tell them apart from the message text and fix each one.
Native fetch isn't subject to CORS at all — but Expo Web, RN Web, and WebView screens run in a real browser and are. How to tell which one you're hitting.
Custom code embeds run in the visitor's browser, so they hit CORS the same way any frontend does. Copy-paste fixes for all three, no backend required.
Free public proxies share one pool of capacity across every user. Why that fails, what to check before picking the next one, and a one-line migration.
CORS isn't what stops you, the secret key is. Keep it out of client-side JavaScript without writing a backend, and know what that still can't protect.
What counts against your daily quota, why you got a 429, when the counter resets, and how it's enforced atomically instead of eventually.
One country was 96% of our traffic and almost none of it real. The WAF rule that stopped it, the expression mistakes that block everyone or no one, and how to check it works.
cors-anywhere, allorigins, ThingProxy, corsproxy.io, and corsproxy.dev. Which ones are still maintained, what their limits are, and what to watch out for.
Your login sets a cookie but the next request comes back logged out. The four moving parts that all have to align, with code and the most common failures.
The one-line dev fix, the production-ready allowlist, the per-route configuration, and the common gotchas — with copy-paste code.
The public cors-anywhere.herokuapp.com demo is rate-limited to ~50 requests per hour. Here's the drop-in migration path with code for vanilla fetch, Axios, and helper wrappers.
Same proxy core, two operational shapes. Cost, control, security, and ops — when each one wins, and how to switch between them.
Vite proxy config, webpack-dev-server, server-side CORS, a flag-disabled browser, and a CORS proxy. Five practical fixes, ordered by how production-safe each one is.
CORS proxies are powerful and, by default, dangerous. Here's how an open relay can be weaponised, and what corsproxy.dev does to make sure ours isn't one.
The browser console says "blocked by CORS policy". What that actually means, why it happens, and three ways to fix it — with code.
Logging policy, GDPR posture, authentication header forwarding, self-hosting options, and other things people email us about.