Install extension
Menu

Patch the request.
Keep your flow.

Inspect, rewrite, mock, and debug traffic in the tab you are already using—no native client, no proxy setup.

Install extension Firefox
Try Playground

Free and open source · No account or proxy server required

Traffic inspector
Tab session
Search requests
GET  /api/profile200
POST  /api/orders201
GET  /api/projects/123200

Fetch · 342 ms

GET  /api/metricsBlocked
GET  /api/search200
GEThttps://api.example.com/api/projects/123200 OK
Initiatorapp.example.comTypeFetchMatched ruleRepair staging API

Request headers

Authorization••••••••••••
Content-Typeapplication/json
Originhttps://app.example.com
✓CORS repaired

Chrome synthesized the preflight locally and patched response headers before enforcement.

Fast when rules are enough.
Deep when they are not.

Keep browser rules for everyday changes. Start a tab session for inspection and temporary controls.

≡

Saved browser rules

Persistent changes across matching pages

  • ✓ Headers, redirects, and blocking
  • ✓ High performance and low overhead
  • ✓ No debugging banner
  • ✓ Always-on rules when you need them
</>

Tab sessions

Explicitly started for the current tab

  • ✓ Inspect requests and responses
  • ✓ Repair CORS responses
  • ✓ Static mocks, delay, and network failure
  • ✓ Chrome shows its standard debugging disclosure

Let your app ask for the capability it needs.

The open-source SDK connects a web app to the locally installed extension. Every request is bound to the real top-level page origin, and CORS changes require user consent.

  1. 1Connect locallyNo account, API key, or cloud relay.
  2. 2Ask for one capabilityCORS access is scoped to the current origin.
  3. 3Create safe draftsApps can prepare disabled rules; users review before enabling.
Read the SDK guide →
app.ts
import { intercept } from 'wireflip';

const session = await intercept.connect();

await session.requestCors({
  reason: 'Preview staging data'
});

// Drafts are disabled until the user reviews them.
await session.createRuleDraft(rule);

Local by design.

Traffic stays on your machine, and powerful access ends with the tab.

No traffic uploadRequests, responses, rules, and logs are not sent to our servers.
No native clientEverything runs inside Chrome or Firefox.
Sensitive headers redactedAuthorization and cookie values are masked in the inspector.
Tab sessionsSessions stop on disable, tab close, or cross-origin navigation. Persistent rules stay on until you turn them off.

Your CORS Unlocker setup comes with you.

The name and product changed. Your existing setup does not disappear.

  1. 1
    One-time migration to v2

    Existing CORS rules and settings are converted automatically.

  2. 2
    Recovery snapshot retained

    A local copy of the v1 data remains available for recovery.

  3. 3
    v2 becomes the only source of truth

    Old settings are not read or dual-written after migration.

Make the browser your request lab.

Install extension Firefox
Get started