Allow CORS: Access-Control-Allow-Origin
Tools
Easily add (Access-Control-Allow-Origin: *) rule to the response header.
Users
800K
Rating
3.4
Reviews
294
7D Growth
0|0%
Stable signalNo paid features detectedHigh-risk permissions
CORS Unblock
No more CORS error by appending 'Access-Control-Allow-Origin: *' header to local and remote web requests when enabled
Users200KCurrent public install base
Rating4.1Store average score
Reviews175Public review volume
Manifest versionV3Extension platform version
7-day growth0Net users gained this week
7-day growth rate0%Relative weekly velocity
Preview
4 assetsCORS Unblock Media preview
Trend
User growth trend
Review user movement across collected snapshots.
User Growth Over Time
Rating trend
7-day rating trend
View collected rating snapshots from the latest 7-day window to assess rating stability.
7-day rating change
Start
4.08
Latest
4.08
7-day rating change
0.00
2026年7月14日2026年7月20日
Growth overview
Daily, weekly, and monthly growth
Compare 1-day, 7-day, and 30-day net growth and growth rate.
1-day growthFlat
00%7-day growthFlat
00%30-day growthFlat
00%Technical snapshot
Version, languages, and crawl freshness
Review publication date, version, supported languages, and crawl timestamps.
Version0.5.2
ManifestV3
Size198KiB
Languages1English
Published
Store updated
Last crawled
English
Overview
Product summary
Review the store description, core capabilities, and common use cases.
This extension bypasses the "XMLHttpRequest" and "fetch" rejections by altering the "Access-Control-Allow-Origin" and "Access-Control-Allow-Methods" headers for every request that the browser receives. You can activate the extension by pressing the action button. Also, use the right-click context menu over the action button to modify which headers the extension manipulates. You can also ask the extension not to overwrite these headers when the server returns values for them.
The default values for the headers:
Access-Control-Allow-Origin: request initiator or empty
Access-Control-Allow-Methods": GET, PUT, POST, DELETE, HEAD, OPTIONS, PATCH, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK
Access-Control-Allow-Methods: request initiator or empty
Access-Control-Allow-Credentials: true
Reviews
Recent review snapshot
Inspect the latest comments and rating distribution.
Store average score4.1Chrome Web Store aggregate rating, including ratings without synced review text
Synced text average4.0Average computed only from synced review bodies below
Reviews with text131Synced review bodies
Total ratings / reviews175Chrome Web Store public rating/review count
Store average score: 4.1. The bars below are calculated from synced review text only, so they may be empty for extensions that have public ratings but no synced comments yet.
Related products
Similar and related extensions
Review related products from the Chrome Web Store detail page.
CSP Unblock
Developer Tools
No more Content-Security-Policy limitations. This extension removes all CSP-related headers during website testing.
Users
7K
Rating
4.0
Reviews
7
7D Growth
0|0%
Cross Domain - CORS
Developer Tools
Cross Domain will help you to deal with cross domain - CORS problem. This is tool helpful when face with cross domain issue.
Users
40K
Rating
3.8
Reviews
77
7D Growth
0|0%
Moesif Origin/CORS Changer & API Logger
Developer Tools
Likely PaidConfidence 92Platform Stripe
Allow cross-domain requests by override Origin and CORS headers. Log/capture XmlHttpRequest API calls for debugging and analytics.
Users
100K
Rating
3.8
Reviews
196
7D Growth
0|0%
Angular DevTools
Developer Tools
Angular DevTools extends Chrome DevTools adding Angular specific debugging and profiling capabilities.
Users
400K
Rating
3.7
Reviews
190
7D Growth
0|0%
Disable Content-Security-Policy
Developer Tools
Disable Content-Security-Policy for web application testing. When the icon is coloured, CSP headers are disabled.
Users
60K
Rating
3.5
Reviews
102
7D Growth
0|0%
Not in this case "The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute" in this case (and, in fact it will work better everywhere), header should be origin of request.
not working on my side
As of today (28 July 2020), CORS Unblock seems to be breaking Youtube video playback. But it's easy enough to keep it disabled most of the time and enable it quickly if I'm doing a bit of AJAX testing.
Не работает, пишет Uncaught DOMException: Blocked a frame with origin "https://ionmc.top" from accessing a cross-origin frame.
Amazing, it solved the problem perfectly
Me encanto
It just works! Period
Only extension that works for me in chrome 80+. Thank you!
nice work
Works perfectly as advertised. Got around that pesky CORS error even when launching HTM files from Windows Explorer (i.e. file:// protocol). Brilliant!