Allow CORS: Access-Control-Allow-Origin
Tools
Easily add (Access-Control-Allow-Origin: *) rule to the response header.
Users
800K
Rating
3.4
Reviews
294
7D Growth
0|0%
Stable signalNo paid features detectedHigh-risk permissions
CORS Unblock
No more CORS error by appending 'Access-Control-Allow-Origin: *' header to local and remote web requests when enabled
Users200KCurrent public install base
Rating4.1Store average score
Reviews175Public review volume
Manifest versionV3Extension platform version
7-day growth0Net users gained this week
7-day growth rate0%Relative weekly velocity
Preview
4 assetsCORS Unblock Media preview
Trend
User growth trend
Review user movement across collected snapshots.
User Growth Over Time
Rating trend
7-day rating trend
View collected rating snapshots from the latest 7-day window to assess rating stability.
7-day rating change
Start
4.08
Latest
4.08
7-day rating change
0.00
2026年7月13日2026年7月19日
Growth overview
Daily, weekly, and monthly growth
Compare 1-day, 7-day, and 30-day net growth and growth rate.
1-day growthFlat
00%7-day growthFlat
00%30-day growthFlat
00%Technical snapshot
Version, languages, and crawl freshness
Review publication date, version, supported languages, and crawl timestamps.
Version0.5.2
ManifestV3
Size198KiB
Languages1English
Published
Store updated
Last crawled
English
Overview
Product summary
Review the store description, core capabilities, and common use cases.
This extension bypasses the "XMLHttpRequest" and "fetch" rejections by altering the "Access-Control-Allow-Origin" and "Access-Control-Allow-Methods" headers for every request that the browser receives. You can activate the extension by pressing the action button. Also, use the right-click context menu over the action button to modify which headers the extension manipulates. You can also ask the extension not to overwrite these headers when the server returns values for them.
The default values for the headers:
Access-Control-Allow-Origin: request initiator or empty
Access-Control-Allow-Methods": GET, PUT, POST, DELETE, HEAD, OPTIONS, PATCH, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK
Access-Control-Allow-Methods: request initiator or empty
Access-Control-Allow-Credentials: true
Reviews
Recent review snapshot
Inspect the latest comments and rating distribution.
Store average score4.1Chrome Web Store aggregate rating, including ratings without synced review text
Synced text average4.0Average computed only from synced review bodies below
Reviews with text131Synced review bodies
Total ratings / reviews175Chrome Web Store public rating/review count
Store average score: 4.1. The bars below are calculated from synced review text only, so they may be empty for extensions that have public ratings but no synced comments yet.
Related products
Similar and related extensions
Review related products from the Chrome Web Store detail page.
CSP Unblock
Developer Tools
No more Content-Security-Policy limitations. This extension removes all CSP-related headers during website testing.
Users
7K
Rating
4.0
Reviews
7
7D Growth
0|0%
Cross Domain - CORS
Developer Tools
Cross Domain will help you to deal with cross domain - CORS problem. This is tool helpful when face with cross domain issue.
Users
40K
Rating
3.8
Reviews
77
7D Growth
0|0%
Moesif Origin/CORS Changer & API Logger
Developer Tools
Likely PaidConfidence 92Platform Stripe
Allow cross-domain requests by override Origin and CORS headers. Log/capture XmlHttpRequest API calls for debugging and analytics.
Users
100K
Rating
3.8
Reviews
196
7D Growth
0|0%
Angular DevTools
Developer Tools
Angular DevTools extends Chrome DevTools adding Angular specific debugging and profiling capabilities.
Users
400K
Rating
3.7
Reviews
190
7D Growth
0|0%
Disable Content-Security-Policy
Developer Tools
Disable Content-Security-Policy for web application testing. When the icon is coloured, CSP headers are disabled.
Users
60K
Rating
3.5
Reviews
102
7D Growth
0|0%
chome should keep this amazing extention is the best for this kind of dev experience
doesn't work for me.
This seems to always modify your requests, not only when it's "active". Headache of a bugfix that was actually machine confinguration
Was working, then stopped.
With the update to Manifest v3, when sending a request with fetch from a homemade Chrome extension, a CORS error will occur 100% of the time, and there is nothing the client can do to avoid it. However, by using this extension, you can receive responses with fetch without them failing with a CORS error. This extension is like a godsend for Chrome extension developers.
Работает отлично, иногда правда так привыкаешь что не замечаешь того, что работает это только локально хд
doesnt work
Not working when CORS header is ignored b/c coming through a unsecure request (http). "The Cross-Origin-Opener-Policy header has been ignored, because the URL's origin was untrustworthy. It was defined either in the final response or a redirect. Please deliver the response using the HTTPS protocol. You can also use the 'localhost' origin instead."
Seems to work well, and does what I needed it to do (allows me to parse HTTP responses on localhost by appending 'Access-Control-Allow-Origin: *' to the header). It supports a number of other configurations, as well, which I don't currently need but are nice to have as options.
Sağol