Security
CORS Security Checker
Inspect cross-origin response and preflight behavior.
Advertisement
What is CORS Security Checker?
CORS Security Checker examines how an API responds to a supplied Origin and also sends an OPTIONS preflight request. It helps developers understand which cross-origin requests a browser may be permitted to make.
What this tool checks
- Access-Control-Allow-Origin
- Access-Control-Allow-Credentials
- Access-Control-Allow-Methods
- Access-Control-Allow-Headers
- OPTIONS preflight status
- Wildcard origin observations
How to use it
- Enter the API endpoint.
- Enter the Origin you want to simulate.
- Run the CORS test.
- Review both the normal response and preflight behavior.
Important:
CORS is a browser security mechanism. An API may intentionally allow broad cross-origin access when it does not rely on browser credentials or expose sensitive authenticated data.
Frequently asked questions
Does CORS protect server-to-server APIs?
CORS is primarily enforced by web browsers, not arbitrary server-side HTTP clients.
Is Access-Control-Allow-Origin * always wrong?
No. It can be appropriate for intentionally public resources, depending on authentication and data sensitivity.