Corstest – ahmadrazalab

To test CORS using `curl`, you can simulate both preflight (OPTIONS) and actual GET/POST requests by setting custom headers.

✅ 1. Test Preflight (OPTIONS) Request

This simulates a browser preflight request:

curl -i -X OPTIONS https://x.x.com \
  -H "Origin: https://example.com" \
  -H "Access-Control-Request-Method: GET" \
  -H "Access-Control-Request-Headers: Content-Type, Authorization"

✅ You should see response headers like:

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Origin, Content-Type, Accept, Authorization
Access-Control-Allow-Credentials: true

✅ 2. Test Actual GET Request with CORS

This simulates a CORS request from a browser-based client:

curl -i -X GET https://x.x.com \
  -H "Origin: https://example.com"

You should see a successful HTTP 200 (or similar) with:

Access-Control-Allow-Origin: *

✅ 3. Test CORS Denial Case (For Comparison)

To validate that CORS is working as expected (not always open), try from an origin that should be blocked (if you configured a specific origin):

curl -i -X GET https://x.x.com \
  -H "Origin: https://unauthorized.com"

You should not see Access-Control-Allow-Origin in the response if the origin is restricted.

🧪 Optional: Verbose Debugging

curl -i -v -X OPTIONS https://x.x.com \
  -H "Origin: https://example.com" \
  -H "Access-Control-Request-Method: GET"

This shows SSL negotiation, redirects, and response headers line by line.

Vpn Azure Aws Curl