Analyze CORS Policy
Enter a URL to test its CORS configuration and identify potential security vulnerabilities.
Browser Testing Limitations
Due to browser CORS restrictions, this tool can only analyze URLs that already allow cross-origin requests from this domain. For comprehensive CORS testing including origin reflection, null origin acceptance, and credential testing, use server-side tools like Burp Suite, OWASP ZAP, or curl.
Need Professional CORS Security Review?
While this tool identifies common CORS misconfigurations, a comprehensive security assessment by our experts provides manual penetration testing, business logic vulnerability assessment, secure policy design, developer training, compliance validation, and remediation support.
How CORS Works
CORS (Cross-Origin Resource Sharing) is a browser security feature that controls how web pages from one domain can request resources from another domain. Understanding how CORS works is essential for building secure APIs and web applications.
Same-Origin Policy
By default, browsers enforce the Same-Origin Policy (SOP), which prevents JavaScript code from one origin (domain, protocol, and port) from accessing resources at a different origin. This is a fundamental security mechanism that prevents malicious websites from stealing data.
Two URLs have the same origin only if they match in protocol, domain, and port. For example:
https://example.com/page1andhttps://example.com/page2- Same origin ✓https://example.comandhttp://example.com- Different origin (protocol) ✗https://example.comandhttps://api.example.com- Different origin (subdomain) ✗https://example.com:443andhttps://example.com:8080- Different origin (port) ✗
CORS Headers
CORS relaxes the Same-Origin Policy by using HTTP headers to tell browsers which cross-origin requests are allowed. The most important CORS headers are:
Access-Control-Allow-OriginSpecifies which origins can access the resource. Can be a specific origin (https://trusted.com), wildcard (*), or null.
Access-Control-Allow-CredentialsIndicates whether cookies and authorization headers can be sent. Must be true (cannot use wildcard origin with credentials).
Access-Control-Allow-MethodsSpecifies which HTTP methods are allowed (GET, POST, PUT, DELETE, etc.).
Access-Control-Allow-HeadersLists which headers can be used in the actual request (e.g., Content-Type, Authorization).
Access-Control-Max-AgeHow long (in seconds) preflight response can be cached. Recommended: 86400 seconds (24 hours) or less.
Simple vs Preflight Requests
CORS distinguishes between simple requests and preflight requests:
Simple Requests
Simple requests are sent directly without a preflight check. They must meet these conditions:
- Method: GET, HEAD, or POST
- Headers: Only Accept, Accept-Language, Content-Language, Content-Type (with limited values)
- Content-Type: application/x-www-form-urlencoded, multipart/form-data, or text/plain
Preflight Requests
Preflight requests are triggered when a request doesn't meet "simple" criteria. The browser sends an OPTIONS request first to check permissions:
- Browser sends OPTIONS request with Access-Control-Request-Method and headers
- Server responds with allowed methods, headers, and origins
- If approved, browser sends the actual request
- Preflight response is cached based on Access-Control-Max-Age
Common CORS Vulnerabilities
🔴 Critical: Wildcard Origin with Credentials
Configuration: Access-Control-Allow-Origin: * + Access-Control-Allow-Credentials: true
Impact: Any website can make authenticated requests and steal user data, sessions, and credentials. This is the most severe CORS misconfiguration.
Attack: Attacker creates malicious website that uses victim's cookies to access your API and exfiltrate data.
Fix: Never use wildcard with credentials. Use explicit origin whitelist: Access-Control-Allow-Origin: https://trusted.com
🟠 High: Origin Reflection
Configuration: Server echoes any origin from request: Access-Control-Allow-Origin: $ORIGIN_HEADER
Impact: Bypasses origin validation entirely. Attackers can access resources from any domain.
Detection: Send request with Origin: https://evil.com - if server responds with same origin, it's vulnerable.
Fix: Validate origin against whitelist server-side before setting CORS headers. Never blindly reflect Origin header.
🟡 Medium: Null Origin Accepted
Configuration: Access-Control-Allow-Origin: null
Impact: Allows exploitation via sandboxed iframes or file:// protocol. Attackers can use <iframe sandbox> to generate null origin.
Attack: Malicious page creates sandboxed iframe that makes requests with null origin.
Fix: Never accept null origin. Only allow explicit trusted domains.
Security Best Practices
Use explicit origin whitelist
Maintain a list of trusted domains. Validate origin server-side against this list.
Never use wildcard with credentials
If credentials are needed, specify exact origin. Wildcard + credentials = critical vulnerability.
Restrict HTTP methods
Only allow necessary methods (GET, POST). Restrict PUT, DELETE, PATCH to authenticated origins.
Include Vary: Origin header
Prevents cache poisoning attacks. Tells caches to vary response based on Origin header.
Set reasonable Max-Age
Limit preflight cache to 24 hours (86400 seconds) or less for timely security updates.
Regular security audits
Audit CORS policies quarterly and after any API changes. Include in CI/CD pipeline.
Test before deployment
Use this tool and other security scanners to verify configuration before going live.
Frequently Asked Questions
Common questions about the CORS Policy Analyzer
CORS (Cross-Origin Resource Sharing) is a security mechanism that allows web servers to specify which origins (domains) can access their resources. It's implemented through HTTP headers and enforced by web browsers. CORS matters because misconfigured policies can lead to serious security vulnerabilities including data theft, session hijacking, and account takeover. According to recent security research, nearly 90% of API breaches begin with misconfigured CORS policies.
Explore More Tools
Continue with these related tools
Password Strength Checker
Test your password strength and get recommendations for improvement
Password Generator
Generate secure random passwords with customizable options
CVE Vulnerability Search
Search and analyze CVE vulnerabilities with CVSS calculator
⚠️ Security Notice
This tool is provided for educational and authorized security testing purposes only. Always ensure you have proper authorization before testing any systems or networks you do not own. Unauthorized access or security testing may be illegal in your jurisdiction. All processing happens client-side in your browser - no data is sent to our servers.