Use this little website to test if a URL is setup correctly to work with CORS.
Shareable link: https://cors-test.codehappy.dev/?method=get&origin=https%3A%2F%2Fchatgpt.com&url=https%3A%2F%2Fcdn.oaistatic.com
These are the response headers received when making the request.
access-control-allow-origin: *
access-control-expose-headers: content-length
cache-control: public, max-age=2592000
cf-cache-status: EXPIRED
cf-ray: a4966ee159a6fad4-CMH
connection: close
content-length: 223
content-type: application/xml
date: Mon, 12 Oct 2026 13:25:53 GMT
expires: Wed, 11 Nov 2026 13:25:53 GMT
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=P5pNnp6gRbwLaXs5rFhTjF7Wz%2BG7XexaYJwibT4QwIinbsHORMglCEDvgA2HLMJfXQD%2B0cbE8kYqB6O7%2B0DSFnbs%2BAZK07vuXWacMiFD8tI1ytxG%2Fia0cKCBnyJV2SqKiMsVDH2WQUaE%2F2C63Ut7MMylbyEBFeDXtQzEB3j4AbQ%3D"}]}
server: cloudflare
set-cookie: __cf_bm=Rl9SlV3gz89af._OVb.pJcEBqt60LpW6LQkVMRsylyA-1791811553.4993682-1.0.1.1-3fBaajqvAGQXO1Yvmh5MoXQs16gaAUKme2LD7uyy97IS1zmbDFq7c1bTcygEYAFwbgpcThzi0KEcfMVi1NGIxVblwGHq5EBRMZ7pG6LF_L7LDXy1owVDFs70Eh5DNgOd; HttpOnly; Secure; Path=/; Domain=oaistatic.com; Expires=Mon, 12 Oct 2026 13:55:53 GMT, _cfuvid=cpl1Me0a82SIr3Wog37.IvTlZQxDF48fEib1IAG8XkI-1791811553.4993682-1.0.1.1-_c79Sl.GesAWzV4YukzW28zdtLyVbzGNggkuzCaLdLA; HttpOnly; SameSite=None; Secure; Path=/; Domain=oaistatic.com
strict-transport-security: max-age=31536000; includeSubDomains; preload
timing-allow-origin: https://chatgpt.com
x-content-type-options: nosniff
x-ms-request-id: ed3e9489-e01e-009a-394d-5adf66000000
x-ms-request-priority: 3
CORS tester was built by @mscccc. The code is available on GitHub. Sponsored by HTML/CSS to Image.