CORS Misconfiguration Checker

Analyze CORS headers instantly. Detect security vulnerabilities, misconfigurations, and common issues that could break your API or expose security risks.

Analyze CORS Configuration

Option 1: Check a URL

Enter a URL to check its CORS headers:

Option 2: Paste CORS Headers

Manually paste your response headers in key:value format:

What is CORS?

Cross-Origin Resource Sharing (CORS) is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served.

CORS headers control which origins can access your API, what methods they can use, and what data they can send.

Common CORS Vulnerabilities

1. Allow All Origins (*)

Access-Control-Allow-Origin: * allows any website to access your API. This is fine for public APIs but dangerous for APIs that handle sensitive data.

2. Wildcard with Credentials

Access-Control-Allow-Credentials: true combined with Access-Control-Allow-Origin: * is invalid and browsers reject it.

3. Overly Permissive Methods

Allowing all HTTP methods when only specific ones are needed increases attack surface.

4. Missing Origin Validation

Dynamically setting Access-Control-Allow-Origin to user-supplied values without validation can bypass origin checks.

CORS Headers Explained

Access-Control-Allow-Origin

Specifies which origins can access the resource.

Access-Control-Allow-Origin: https://example.com

Access-Control-Allow-Methods

Specifies which HTTP methods are allowed.

Access-Control-Allow-Methods: GET, POST, PUT, DELETE

Access-Control-Allow-Headers

Specifies which headers can be sent with requests.

Access-Control-Allow-Headers: Content-Type, Authorization

Access-Control-Allow-Credentials

Indicates whether credentials can be sent.

Access-Control-Allow-Credentials: true

CORS Best Practices