Use this little website to test if a URL is setup correctly to work with CORS.
Shareable link: https://cors-test.codehappy.dev/?method=get&origin=https%3A%2F%2Fcors-test.codehappy.dev%2F&url=https%3A%2F%2Fmojobus.org%2F.well-known%2Fnostr.json
It does not have the access-control-allow-origin header set to *. Without this header, requests from other domains cannot be made to it via a users browser.
If you have access to the server for the URL, you'll need to modify it to add the access-control-allow-origin header. If you do not have access, you'll need to upload the file somewhere else.
These are the response headers received when making the request.
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
cf-ray: a3d8c9b2a975e88e-CMH
connection: close
content-length: 5315
content-security-policy: default-src 'none'; script-src 'nonce-jUDYHoVazORuyfl3VUilDd' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Sat, 19 Sep 2026 13:02:58 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
referrer-policy: same-origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=brNIztPtDrkH8cbryxS12M%2BY3mpTbGui83h8XZreuwj%2BijEVUGEpvjhu6cUad%2FGc49SFNvjJH4Tg2imktTaChUEuvrrSNtsGHaV7BU5AnSNPVIxBVilg3O4a5LuSVzGe6kp5uD22E1ZI"}]}
server: cloudflare
server-timing: chlray;desc="a3d8c9b2a975e88e"
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
CORS tester was built by @mscccc. The code is available on GitHub. Sponsored by HTML/CSS to Image.