Chrome Web Store
Firefox Add-ons
Source CodeOne switch per site
Turn it on for the site you are on and the badge reads ON. One switch for localhost covers every port your dev servers use, and subdomains are covered too.
CORS Unblocker
Fix “blocked by CORS policy” errors while you develop.
One switch unblocks the cross-origin fetch and XMLHttpRequest calls of the site you are on, cookies included. No modes, no lists, no proxy — and nothing leaves your machine.
Chrome, Edge, Brave, Opera and Firefox.
How it works
Exact origin, cookies included
Responses get your site’s exact origin with credentials — not *, which is illegal on cookie-sending requests. So cookie-based APIs work with the same switch.
Nothing else is touched
Page loads, downloads, sign-in redirects and streaming are left alone. No script is injected into the page, and the page cannot tell the extension is there.
Off everywhere else
It follows the tab you are looking at, and other sites stay blocked. A list of every enabled site lets you turn any of them off, or all at once.
Good to know
Browser limits, stated plainly.
A preflight answered with an error status or a redirect still fails — the browser needs a 2xx reply, and declarative rules change headers but not status codes. Fix the server, or call the final URL directly.
Unusual custom headers on cookie-sending requests can still be refused, third-party cookies follow the browser’s own settings, and chrome:// pages, the Web Store and file:// pages are out of reach. WebSockets are not CORS-protected and are not touched.
The server still sees you: this changes what the browser enforces, not what the server allows. Every working case — and the fact that other sites stay blocked — is asserted by automated end-to-end tests against a real Chrome.
Frequently asked questions
- Is CORS Unblocker free?
- Yes. CORS Unblocker is free and open source under the MIT license. There is no account, no ads and no paid version.
- How do I install it?
- Install it from the Chrome Web Store for Chrome, Edge, Brave and Opera, or from Firefox Add-ons for Firefox. Developers can also load the source unpacked in Chrome, or build it for Firefox.
- Why does it ask for access to every website?
- The servers your site calls can be on any domain, and the extension needs access to them to change their CORS headers. The headers only change for requests made by the sites you switched on, and the browser applies the rules itself: the extension never sees request or response contents and injects no scripts.
- Does it collect any data?
- No. It stores only the list of sites you switched it on for, on your computer, and makes no network requests of any kind: no analytics, no telemetry, no crash reports.
Install
Grab it from the Chrome Web Store for Chrome, Edge, Brave and Opera, from Firefox Add-ons for Firefox — or read the source and load it unpacked.