No more CORS error by appending 'Access-Control-Allow-Origin: *' header to local and remote web requests when enabled

Latest Version

Version
0.3.8
Update
February 10, 2024
Size
203KiB
Developer
Category
Users
200,000+
Rating
4.16049 ★
Manifest Version
2
Web Store Status
Languages Support
English
See more
Permissions
Storage

WebRequest
WebRequestBlocking
DeclarativeNetRequest
ContextMenus
Debugger
See more

CORS Unblock Extension

This extension bypasses the \"XMLHttpRequest\" and \"fetch\" rejections by altering the \"Access-Control-Allow-Origin\" and \"Access-Control-Allow-Methods\" headers for every request that the browser receives. You can activate the extension by pressing the action button. Also, use the right-click context menu over the action button to modify which headers the extension manipulates. You can also ask the extension not to overwrite these headers when the server returns values for them.

The default values for the headers:

Access-Control-Allow-Origin: request initiator or empty
Access-Control-Allow-Methods\": GET, PUT, POST, DELETE, HEAD, OPTIONS, PATCH, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK
Access-Control-Allow-Methods: request initiator or empty
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: request initiator or *

Additional Features:
1. It can remove the following CSP-related headers:
\"Content-Security-Policy\", \"Content-Security-Policy-Report-Only\", \"X-WebKit-CSP\" and \"X-Content-Security-Policy\".

2. It can overwrite the returned 4xx status code from the server. Use this feature when a server does not support a method, but you want to pretend it does.

3. It can append necessary headers to pretend websites (local or remote hosts) support SharedArrayBuffer class.

4. It can permit cross-origin frame embedding (by removing the \"X-Frame-Options\" header) to simplify remote page embedding during local development.

5. It can include or exclude the \"referer\" and \"origin\" headers when a server is sensitive to them to work appropriately.

6. The extension optionally uses the \"chrome.debugger\" to overwrite 4xx status codes (in case a server does not support a method, you can use this feature to pretend the server accepts a response or supports an unsupported method).

7. The extension also optionally fixes CORS policies of redirected URLs.

--
It is important to note that this extension fixes preflight requests to permit access to any custom header (when enabled).

Links:
1. For reporting bugs, please use the link https://github.com/balvin-perrie/Access-Control-Allow-Origin---Unblock.

2. To have better control over CSP (content-security-policy), try my https://chrome.google.com/webstore/detail/csp-unblock/lkbelpgpclajeekijigjffllhigbhobd.
Read more

Source Manifest.json

{"update_url": "https://clients2.google.com/service/update2/crx", "manifest_version": 2, "version": "0.3.8", "name": "CORS Unblock", "description": "__MSG_description__", "default_locale": "en", "permissions": [ "storage", "", "webRequest", "webRequestBlocking", "declarativeNetRequest", "contextMenus", "debugger" ], "declarative_net_request" : { "rule_resources" : [{ "id": "x-frame", "enabled": false, "path": "rulesets/x-frame.json" }, { "id": "overwrite-origin", "enabled": false, "path": "rulesets/overwrite-origin.json" }, { "id": "allow-credentials", "enabled": false, "path": "rulesets/allow-credentials.json" }, { "id": "allow-headers", "enabled": false, "path": "rulesets/allow-headers.json" }, { "id": "referer", "enabled": false, "path": "rulesets/referer.json" }, { "id": "csp", "enabled": false, "path": "rulesets/csp.json" }, { "id": "allow-shared-array-buffer", "enabled": false, "path": "rulesets/allow-shared-array-buffer.json" }] }, "icons": { "16": "/data/icons/16.png", "32": "/data/icons/32.png", "48": "/data/icons/48.png", "64": "/data/icons/64.png", "128": "/data/icons/128.png", "256": "/data/icons/256.png", "512": "/data/icons/512.png" }, "homepage_url": "https://webextension.org/listing/access-control.html", "browser_action":{}, "background": { "scripts": [ "worker.js", "context.js", "v2.js" ] }}
Read more

Similar Extensions

icon

Allow CORS: Access-Control-Allow-Origin Extension · Productivity 200,000+ 279 ★ 78.31KiB

icon

EASY CORS Extension · Developer Tools 200,000+ 19 ★ 55.17KiB

icon

CSP Unblock Extension · Developer Tools 200,000+ 2 ★ 114KiB

icon

Cross Domain - CORS Extension · Developer Tools 200,000+ 65 ★ 121KiB

icon

Moesif Origin/CORS Changer & API Logger Extension · Developer Tools 200,000+ 191 ★ 823KiB

icon

Angular DevTools Extension · Developer Tools 200,000+ 159 ★ 3.2MiB

icon

CORS Helper Extension · Developer Tools 200,000+ 3 ★ 67.38KiB

icon

Disable Content-Security-Policy Extension · Developer Tools 200,000+ 91 ★ 29.02KiB

icon

React Developer Tools Extension · Developer Tools 200,000+ 1576 ★ 1.56MiB

icon

CORS Unblock Extension · Developer Tools 200,000+ 6 ★ 12.65KiB

icon

Local-CORS Extension · Developer Tools 200,000+ 7 ★ 1.58MiB

icon

Always Disable Content-Security-Policy Extension · Developer Tools 200,000+ 18 ★ 13.2KiB

icon

Mokku Extension · Developer Tools 200,000+ 76 ★ 3.28MiB

icon

Apollo Client Devtools Extension · Developer Tools 200,000+ 266 ★ 490KiB

icon

Vue.js devtools Extension · Developer Tools 200,000+ 2131 ★ 2.57MiB

icon

Redux DevTools Extension · Developer Tools 200,000+ 726 ★ 1.2MiB

icon

tweak: mock and modify HTTP requests Extension · Developer Tools 200,000+ 190 ★ 3.22MiB

icon

Vue.js devtools (beta) Extension · Developer Tools 200,000+ 149 ★ 2.54MiB

icon

MobX Developer Tools Extension · Developer Tools 200,000+ 51 ★ 682KiB

icon

Requestly - Intercept, Modify & Mock HTTP Requests Extension · Developer Tools 200,000+ 1227 ★ 876KiB

icon

Angular state inspector Extension · Developer Tools 200,000+ 64 ★ 36.35KiB

icon

React Context DevTool Extension · Developer Tools 200,000+ 21 ★ 2.35MiB

icon

WebSocket Test Client Extension · Developer Tools 200,000+ 31 ★ 129KiB

icon

LocatorJS Extension · Developer Tools 200,000+ 64 ★ 190KiB

User reviews

icon

kaleem ullah (ID: 000000f8785a519c) Voted 3 ★ - Updated 09/28/2023 It works 60% of the time that's why 3 stars, other times I get "has been blocked by CORS policy: Request header field content-type is not allowed by Access-Control-Allow-Headers in preflight response."

icon

M (ID: 00000065b9620878) Voted 5 ★ - Updated 09/26/2023 Macht was es soll. Daumen hoch

icon

Gabriela Sartori (ID: 00000021c44dc9f0) Voted 5 ★ - Updated 09/06/2023 It's the only CORS chrome extension that works for me

icon

Mehdi Moradi (Aryan) (ID: 00000027c32045eb) Voted 5 ★ - Updated 06/21/2023 Thankyou buddy 😍👍

icon

Burhan Dev (ID: 00000047f9acb8c3) Voted 5 ★ - Updated 06/13/2023 Solved my problem