Fix CORS errors while you develop: allow CORS only for the sites you pick, with cookies supported and automatic shut-off.
Users
11
store count
Rating
5.0 / 5
unchanged in 30 days
Ratings
3
total ratings
Store rank
#185K
#155K among extensions
Version
0.3.0
updated 9 Oct 2026
About CORS Switch — Allow CORS per site
Getting "blocked by CORS policy" while you develop? CORS Switch lets your app call any API by adding the right Access-Control-Allow-Origin headers — only for the sites you choose, and only for as long as you need.
HOW IT WORKS
1. Open your app (for example http://localhost:3000).
2. Click the CORS Switch icon and turn it on for this site.
3. Reload — your fetch and XHR requests to other domains now pass the CORS check.
WHY DEVELOPERS USE IT
• Per-site, not global — CORS is allowed only for requests made by the sites you enable. Every other website keeps normal browser security.
• Credentials that work — CORS Switch echoes your exact origin and sets Access-Control-Allow-Credentials, so requests with cookies or an Authorization header work. Most "Allow CORS" extensions send "*", which browsers reject for credentialed requests.
• Preflight headers — PUT, PATCH, DELETE and common headers like Authorization and Content-Type are allowed.
• Auto shut-off — each site switches off automatically after 1 hour, so you never browse the web with CORS disabled by accident.
• Always visible — the toolbar icon shows ON when CORS is allowed for the current tab.
• Private by design — built on Chrome's declarativeNetRequest API. No account, no analytics, no data collection. Your requests never leave your browser.
CORS SWITCH PRO
Unlimited sites, custom shut-off timers, extra allowed headers, "Send Origin as" and settings import/export — $2.99/month or $19 once for a lifetime license. Get a key at https://cors.zelenye.com and paste it in the extension options.
GOOD TO KNOW
• Use CORS Switch for development and testing, not for everyday browsing.
• Some servers reject unknown origins themselves: Spring answers "403 Invalid CORS request", FastAPI rejects the preflight with 400. Pro's "Send Origin as" sends requests and preflights with an Origin from the server's allow-list, so they pass.
• If a server answers the OPTIONS preflight with an error status for another reason (404/405), the browser still blocks the request — an extension cannot change status codes.
Questions or bugs: support@zelenye.com