Use this little website to test if a URL is setup correctly to work with CORS.
Shareable link: https://cors-test.codehappy.dev/?method=get&origin=https%3A%2F%2Fcors-test.codehappy.dev%2F&url=https%3A%2F%2Fmojobus.org%2F.well-known%2Fnostr.json
It does not have the access-control-allow-origin header set to *. Without this header, requests from other domains cannot be made to it via a users browser.
If you have access to the server for the URL, you'll need to modify it to add the access-control-allow-origin header. If you do not have access, you'll need to upload the file somewhere else.
These are the response headers received when making the request.
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
cf-ray: a553a4eb5e1f1cc4-CMH
connection: close
content-length: 5304
content-security-policy: default-src 'none'; script-src 'nonce-7j8vVeuKuM9013Ox0leM5H' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Wed, 04 Nov 2026 12:32:55 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
referrer-policy: same-origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=LpLXi%2FjupYgPqC%2BAnVPLygO6OfV%2Bj8GRSSGmHG8wAquF146UrGKSffTSpIuDV1dvt9tO01uZN%2Fbfj24zea%2FcMM8fpO8wVA7d9uCrh2Ks6OyUXj3g0QY24ac4KvDzj3%2B%2F8D6CS6q1rymU"}]}
server: cloudflare
server-timing: chlray;desc="a553a4eb5e1f1cc4"
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
CORS tester was built by @mscccc. The code is available on GitHub. Sponsored by HTML/CSS to Image.