FreeTools logo CORS Proxy

Use the form above. Parameters, code examples and FAQ are grouped in the documentation section below.



Description
- Free CORS proxy server to bypass same-origin policy related to performing standard AJAX requests to 3rd party services.
You can use it to prevent mixed content of images and JSON data proxying the resources to serve them under https.
- API URL => "/v1/proxy?quest=URL"
- Each request is limited to 5mb size download to avoid abuse. Private/internal IPs are blocked (SSRF guard).
- Only supports GET request.
 - Limit : 30 requests per minute. Once reached subsequent requests will result in error 429 (too many requests) until your quota is cleared.
Endpoint - Do cors proxy
HTTP Request:
GET /v1/proxy?quest=URL
Examples
Access resources from other website :
/v1/proxy?quest=https://api.github.com/zen
Serve an http image as https preventing mixed content :
/v1/proxy?quest=https://httpbin.org/image/png
Try it live

    

  


  


  
  

  
Related tools

  

  

  Documentation & API reference
  

  
How to use the CORS Proxy

  
Fetch a cross-origin URL from the browser by proxying the request server-side, with SSRF protection and a 5 MB cap.

  
Endpoints

  
EndpointReturnsExample

  
/v1/proxyproxied bodyquest=https://example.com

  

  
Parameters

  
NameTypeDefaultDescription

  
queststringrequiredFull URL to fetch. A bare domain is upgraded to https automatically.

  

  
Code examples

  

  
curl 'https://freetools.one/v1/proxy?quest=https://example.com'

  
// same request works from a browser despite CORS
const res = await fetch('https://freetools.one/v1/proxy?quest=https://example.com');
console.log(await res.text());

  
import requests

body = requests.get('https://freetools.one/v1/proxy',
                  params={'quest': 'https://example.com'}).text
print(body[:200])

  
Example response

  
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8

<!-- the upstream body, unmodified -->

  
Frequently asked questions

  

  
How do I bypass the CORS error in JavaScript?
Send your request to /v1/proxy?quest=<encoded URL> instead of the target host. FreeTools fetches it server-side and returns the body with CORS enabled, so the browser accepts it.

  
Is the proxy safe to call from untrusted users?
Every request is checked against an SSRF guard that resolves the hostname and rejects loopback, link-local, private and cloud metadata ranges on every redirect hop.

  
How large a response can I fetch?
Up to 5 MB. Anything larger is rejected with HTTP 413 rather than being buffered indefinitely.

  
Does the proxy follow redirects?
Yes, up to 5 hops, and each destination is re-validated so a public URL cannot bounce to an internal address.