Free CORS Tester
Check how any URL responds to cross-origin requests. Send a custom Origin header, inspect the Access-Control-* response and preflight headers, and instantly flag misconfigurations like origin reflection with credentials — the pattern behind real CORS data-leak bugs.
Reading your CORS results
The most important field is Access-Control-Allow-Origin (ACAO). If it echoes back the exact arbitrary origin you sent, the server is reflecting origins rather than checking them against an allowlist — a red flag. If it returns *, the endpoint is open to any site for non-credentialed reads. If it's absent or pinned to a specific trusted origin, cross-origin reads from other sites are blocked.
Access-Control-Allow-Credentials: true is the multiplier. Combined with a reflected origin, it turns a cosmetic issue into a serious vulnerability, because a victim's cookies ride along and the attacker's site can read the authenticated response. The tester grades this combination as high severity. It also checks for a 'Vary: Origin' header, whose absence can cause shared caches to serve one origin's CORS response to a different origin.
How to fix a CORS misconfiguration
Never build Access-Control-Allow-Origin by reflecting the request's Origin header unconditionally. Maintain an explicit allowlist of the origins your frontend actually uses, compare the incoming Origin against it, and only then echo it back. For public APIs that serve no private data, a static wildcard is fine and simpler than reflection.
Only send Access-Control-Allow-Credentials: true when you genuinely need cookies or authorization headers on cross-origin requests, and when you do, pair it with a strict, exact-match origin allowlist — never a wildcard and never reflection. After changing your policy, re-test with several origins (including one that should be rejected) to confirm the allowlist behaves. For the endpoints behind your CORS layer, a full Vuln0x scan checks the authentication and injection surface that CORS alone can't protect.
Frequently asked questions
- What is CORS?
- Cross-Origin Resource Sharing (CORS) is a browser mechanism that decides whether JavaScript running on one origin may read responses from another origin. By default the browser blocks cross-origin reads (the same-origin policy). A server opts specific origins back in by returning Access-Control-Allow-Origin and related headers. CORS is enforced by the browser, not the server, which is why misconfigurations are easy to miss.
- How does this CORS tester work?
- Enter a URL and the origin you want to simulate. The tool sends a GET request with that Origin header plus a preflight OPTIONS request, then reads the Access-Control-* response headers. It flags risky patterns — a wildcard origin, an arbitrary origin reflected back, or credentials allowed alongside a permissive origin — and shows you the raw header values.
- What is a dangerous CORS misconfiguration?
- The classic high-severity case is a server that reflects whatever Origin it receives into Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. That combination lets any malicious website make authenticated requests as a logged-in victim and read the responses — leaking private data. Reflecting arbitrary origins without credentials is less severe but still signals the allowlist isn't validating.
- Is Access-Control-Allow-Origin: * a vulnerability?
- Not by itself. A wildcard is appropriate for genuinely public, unauthenticated APIs. It becomes a problem when the endpoint returns user-specific or sensitive data, because any site can then read it. Note that browsers refuse to combine a wildcard origin with credentials, so a wildcard cannot leak authenticated responses — but it's still worth confirming the data behind it is truly public.
- Does a missing CORS header mean my API is secure?
- It means browsers block cross-origin reads for that endpoint, which is the safe default — but CORS only governs browser-based reads. It does not protect against server-to-server requests, CSRF on state-changing endpoints, or missing authentication. Treat CORS as one piece of your API security posture and test the rest with a full scan.
Go beyond a single check
This tool covers one surface. Vuln0x runs 40+ scanners — headers, TLS, injection, auth, and more — and grades your site in under 60 seconds. Free, no credit card.