CORS Checker
See what a site tells the browser about cross-origin access.
CORS is not a lock on your API — it is an instruction to the browser about which web pages may read the response. The request usually still reaches your server and still executes; what CORS controls is whether JavaScript on another origin gets to see what came back. Anything relying on CORS for actual access control is already broken, because a script outside a browser ignores it entirely.
The misconfiguration that matters is reflection with credentials. A server that echoes whatever Origin it receives and also sends Access-Control-Allow-Credentials: true has told the browser that any website may make authenticated requests and read the answers. A user who is logged into your application and visits an attacker's page has their data read out of your API by that page, with their own cookies.
This tool sends an Origin that is certainly not on anyone's allowlist. If the response comes back naming that origin, the server is reflecting rather than checking. What it cannot tell you from outside is whether the reflection is unconditional or whether your allowlist happens to be generous — that answer is in your configuration, and this is the prompt to go and read it.
What this tool does
A real cross-origin request
The check sends an Origin header from a domain that is deliberately not yours, so a server that reflects any origin reveals itself.
The dangerous combinations
Reflected origin with credentials, and wildcard with credentials, are called out as critical — the rest is reported as configuration.
Cache poisoning check
A response that varies by Origin without saying Vary: Origin lets a shared cache serve one site’s permissive answer to another.
Honest about limits
From outside, a reflected origin and a correctly allowlisted one look identical. That distinction is flagged rather than guessed at.
Frequently asked questions
What is CORS?
Cross-Origin Resource Sharing is a browser mechanism that lets a server say which other origins may read its responses. Without it, the same-origin policy stops a page on one domain reading a response from another. CORS is the server's way of making a deliberate exception.
Is a wildcard Access-Control-Allow-Origin a vulnerability?
Not by itself. For genuinely public data — a public API, a font, an open dataset — a wildcard is the correct configuration. It becomes a problem when the endpoint returns anything specific to the requesting user, because then any site can read it. Browsers refuse to combine a wildcard with credentials for exactly this reason.
Why is reflecting the Origin header dangerous?
Because reflecting it unconditionally means every origin is allowed, while looking like a specific allowlist. Combined with Allow-Credentials: true, any page a logged-in user visits can make authenticated requests to your API and read the responses. The fix is to compare the incoming origin against a fixed list and echo it only on a match.
What does Vary: Origin do?
It tells caches that the response depends on the request's Origin header. Without it, a CDN or proxy can cache the response generated for one origin and serve it to another — turning a correct allowlist into an accidental wildcard for as long as the cache entry lives.
Does CORS protect my API from attackers?
No. CORS is enforced by browsers, not by your server. curl, a script, a mobile app or a proxy will happily call your endpoint and read the response regardless of what CORS headers you send. Authentication and authorisation are what protect an API; CORS only governs what browser JavaScript on other origins may see.
Why does my browser say a preflight failed?
A request that is not "simple" — a custom header, a JSON content type, a method beyond GET/POST/HEAD — triggers an OPTIONS preflight first. If the server does not answer that OPTIONS request with matching Allow-Methods and Allow-Headers, the real request is never sent. Preflights are commonly missed because they need routing of their own.
Can this tool test a preflight?
It sends a normal cross-origin GET with an Origin header, which is what reveals reflection and the credentials combination. A full preflight test needs the specific method and headers your application uses, so it is better run from your own environment with the request you actually make.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.