> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ahmadraza.in/llms.txt
> Use this file to discover all available pages before exploring further.

# CORStest

## To **test CORS using `curl`**, you can simulate both **preflight (OPTIONS)** and **actual GET/POST** requests by setting custom headers.

***

## ✅ 1. **Test Preflight (OPTIONS) Request**

This simulates a browser preflight request:

```bash theme={null}
curl -i -X OPTIONS https://x.x.com \
  -H "Origin: https://example.com" \
  -H "Access-Control-Request-Method: GET" \
  -H "Access-Control-Request-Headers: Content-Type, Authorization"
```

### ✅ You should see response headers like:

```http theme={null}
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Origin, Content-Type, Accept, Authorization
Access-Control-Allow-Credentials: true
```

***

## ✅ 2. **Test Actual GET Request with CORS**

This simulates a CORS request from a browser-based client:

```bash theme={null}
curl -i -X GET https://x.x.com \
  -H "Origin: https://example.com"
```

You should see a successful HTTP `200` (or similar) with:

```http theme={null}
Access-Control-Allow-Origin: *
```

***

## ✅ 3. **Test CORS Denial Case (For Comparison)**

To validate that CORS is working as expected (not always open), try from an origin that should be blocked (if you configured a specific origin):

```bash theme={null}
curl -i -X GET https://x.x.com \
  -H "Origin: https://unauthorized.com"
```

You **should not** see `Access-Control-Allow-Origin` in the response if the origin is restricted.

***

### 🧪 Optional: Verbose Debugging

```bash theme={null}
curl -i -v -X OPTIONS https://x.x.com \
  -H "Origin: https://example.com" \
  -H "Access-Control-Request-Method: GET"
```

This shows SSL negotiation, redirects, and response headers line by line.