CORS Unblock icon

CORS Unblock

by balvin.perrie

v0.5.2 Updated Jun 3, 2025 198KiB
CWS
200K
Users
★ 4.09
176 reviews
#138
of 32.2K
developer
#13 of 2.4K
⚠️Requests 1 sensitive permission

Description

This extension bypasses the "XMLHttpRequest" and "fetch" rejections by altering the "Access-Control-Allow-Origin" and "Access-Control-Allow-Methods" headers for every request that the browser receives. You can activate the extension by pressing the action button. Also, use the right-click context menu over the action button to modify which headers the extension manipulates. You can also ask the extension not to overwrite these headers when the server returns values for them. The default values for the headers: Access-Control-Allow-Origin: request initiator or empty Access-Control-Allow-Methods": GET, PUT, POST, DELETE, HEAD, OPTIONS, PATCH, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK Access-Control-Allow-Methods: request initiator or empty Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: request initiator or * Additional Features: 1. It can remove the following CSP-related headers: "Content-Security-Policy", "Content-Security-Policy-Report-Only", "X-WebKit-CSP" and "X-Content-Security-Policy". 2. It can overwrite the returned 4xx status code from the server. Use this feature when a server does not support a method, but you want to pretend it does. 3. It can append necessary headers to pretend websites (local or remote hosts) support SharedArrayBuffer class. 4. It can permit cross-origin frame embedding (by removing the "X-Frame-Options" header) to simplify remote page embedding during local development. 5. It can include or exclude the "referer" and "origin" headers when a server is sensitive to them to work appropriately. 6. The extension optionally uses the "chrome.debugger" to overwrite 4xx status codes (in case a server does not support a method, you can use this feature to pretend the server accepts a response or supports an unsupported method). 7. The extension also optionally fixes CORS policies of redirected URLs. -- It is important to note that this extension fixes preflight requests to permit access to any custom header (when enabled). Links: 1. For reporting bugs, please use the link https://github.com/balvin-perrie/Access-Control-Allow-Origin---Unblock. 2. To have better control over CSP (content-security-policy), try my https://chrome.google.com/webstore/detail/csp-unblock/lkbelpgpclajeekijigjffllhigbhobd.
CORS Unblock screenshot 1CORS Unblock screenshot 2

Reviews (31 cached)

★☆☆☆☆2025-10-13
Rick Kerry

doesn't work

★☆☆☆☆2025-05-29
Carol Rizzi

Used to be the ONLY extension that works with my client's app, but after the recent update it does not work at all. Automatically turns off when I reload the page. Now I have zero extensions that work for me :(

★☆☆☆☆2025-05-18
G Test

Just after the new update does not work as well as before anymore It has become so complicated and I get errors with cors. Can you please downgrade again. Please fix. It was a five star extension.

★☆☆☆☆2025-05-02
Tushar Thakare

WHY YOU UPDATED !!!! what did you do !! It was my fav extension , after update it is not working unfortunately , on local files it gets auto off when i reload.

★☆☆☆☆2024-11-04
hikmat ullah

not working for me

★☆☆☆☆2024-07-23
yingdong mao

doesn't work for me.

★☆☆☆☆2024-05-23
Makaylah Bennett

doesnt work

★☆☆☆☆2024-04-08
me notyou

Not working when CORS header is ignored b/c coming through a unsecure request (http). "The Cross-Origin-Opener-Policy header has been ignored, because the URL's origin was untrustworthy. It was defined either in the final response or a redirect. Please deliver the response using the HTTPS protocol. You can also use the 'localhost' origin instead."

★☆☆☆☆2023-12-08
Leonardo Covari

Don't work

★☆☆☆☆2022-03-17
PNam

not work

★☆☆☆☆2021-08-11
Luiz Henrique Rios

Not working

★☆☆☆☆2021-05-01
bedoui wejdene

It doesn't work ! Avoid this extension

★☆☆☆☆2020-12-12
Eoin Ó Raghallaigh

Didn't work. Simple as that.

★☆☆☆☆2020-12-08
T. Amagai

This does not work for local html & local file. Sample html is below: --- <html> <body> <script type="text/javascript" src="https://mozilla.github.io/pdf.js/build/pdf.js"></script> <script type="text/javascript" src="https://mozilla.github.io/pdf.js/build/pdf.worker.js"></script> <script type="text/javascript"> var url = "file:///Users/amagaiwork/Desktop/sample.pdf"; var pages = [], heights = [], width = 0, height = 0, currentPage = 1; var scale = 1.5; function draw() { var canvas = document.createElement('canvas'), ctx = canvas.getContext('2d'); canvas.width = width; canvas.height = height; for(var i = 0; i < pages.length; i++) ctx.putImageData(pages[i], 0, heights[i]); document.body.appendChild(canvas); } pdfjsLib.disableWorker = true; // due to CORS const loadingTask = pdfjsLib.getDocument(url); loadingTask.promise.then(function (pdf) { getPage(); function getPage() { pdf.getPage(currentPage).then(function(page) { console.log("Printing " + currentPage); var viewport = page.getViewport(scale); var canvas = document.createElement('canvas') , ctx = canvas.getContext('2d'); var renderContext = { canvasContext: ctx, viewport: viewport }; canvas.height = viewport.height; canvas.width = viewport.width; page.render(renderContext).then(function() { pages.push(ctx.getImageData(0, 0, canvas.width, canvas.height)); heights.push(height); height += canvas.height; if (width < canvas.width) width = canvas.width; if (currentPage < pdf.numPages) { currentPage++; getPage(); } else { draw(); } }); }); } }); </script> </body> </html>

★☆☆☆☆2020-08-04
Array Iterator

OK!! it work with cors, but your extension broke another site :|

★☆☆☆☆2020-02-12
DangerD D

Doesn't work

★☆☆☆☆2020-01-27
Erhan Saydam

Does not run on Chrome 79.

★☆☆☆☆2019-10-09
Nazar Paruna

It doesn't work!

★☆☆☆☆2019-09-25
Mehdi Daalvand

not working

★★☆☆☆2025-05-12
Oleksandr Boiko

Does not work

★★☆☆☆2024-07-02
Justice Almanzar

This seems to always modify your requests, not only when it's "active". Headache of a bugfix that was actually machine confinguration

★★☆☆☆2021-08-11
George Messi

Did not work. Only replaced the error I was receiving with a different one.

★★☆☆☆2021-04-12
David Klempfner

Doesn't work. I'm using Version 89.0.4389.114 (Official Build) (64-bit).

★★☆☆☆2021-03-17
Carlos de la Orden

Be careful this breaks other apps, like Hangouts inside Gmail. It is supposed to unblock, not to block content. Not recommended, but if you really need to use it for development purposes, enable it only after clicking on it on specific websites. Your general web surfing will be affected otherwise.

★★☆☆☆2020-07-28
Kenet brown

not working on my side

★★★☆☆2024-06-14
Ryan Gilmore

Was working, then stopped.

★★★☆☆2024-03-20
Cristian Enache

It has a BIG BUG when "credentials": "includes" exists in fetch request. The extension puts wildcard * in Access-Control-Allow-Methods and this make CORS to block the request.

★★★☆☆2023-09-28
kaleem ullah

It works 60% of the time that's why 3 stars, other times I get "has been blocked by CORS policy: Request header field content-type is not allowed by Access-Control-Allow-Headers in preflight response."

★★★☆☆2022-07-14
Roy

It did its job, but make sure to disable it completely when you don't use it. It caused whatsapp web to stop functioning, even when it was not running.

★★★☆☆2021-01-20
Andrew P

Breaks drive.google.com for me if enabled for all sites.

★★★☆☆2020-08-04
alexey

Not in this case "The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute" in this case (and, in fact it will work better everywhere), header should be origin of request.

Permissions (3)

Permissions

debugger Can use Chrome's debugging protocol on other tabs declarativeNetRequest Can block or redirect network requests storage Can store data locally in your browser

Details

Version 0.5.2
Updated Jun 3, 2025
Size 198KiB
First Seen Mar 22, 2026