Home/Tools/CORS Policy Analyzer

CORS Policy Analyzer

Detect and analyze CORS misconfigurations that could lead to data exposure and security breaches. Test origin validation, credential handling, and policy implementation.

Analyze CORS Policy

Enter a URL to test its CORS configuration and identify potential security vulnerabilities.

Browser Testing Limitations

Due to browser CORS restrictions, this tool can only analyze URLs that already allow cross-origin requests from this domain. For comprehensive CORS testing including origin reflection, null origin acceptance, and credential testing, use server-side tools like Burp Suite, OWASP ZAP, or curl.

Need Professional CORS Security Review?

While this tool identifies common CORS misconfigurations, a comprehensive security assessment by our experts provides manual penetration testing, business logic vulnerability assessment, secure policy design, developer training, compliance validation, and remediation support.

How CORS Works

CORS (Cross-Origin Resource Sharing) is a browser security feature that controls how web pages from one domain can request resources from another domain. Understanding how CORS works is essential for building secure APIs and web applications.

Same-Origin Policy

By default, browsers enforce the Same-Origin Policy (SOP), which prevents JavaScript code from one origin (domain, protocol, and port) from accessing resources at a different origin. This is a fundamental security mechanism that prevents malicious websites from stealing data.

Two URLs have the same origin only if they match in protocol, domain, and port. For example:

  • https://example.com/page1 and https://example.com/page2 - Same origin ✓
  • https://example.com and http://example.com - Different origin (protocol) ✗
  • https://example.com and https://api.example.com - Different origin (subdomain) ✗
  • https://example.com:443 and https://example.com:8080 - Different origin (port) ✗

CORS Headers

CORS relaxes the Same-Origin Policy by using HTTP headers to tell browsers which cross-origin requests are allowed. The most important CORS headers are:

Access-Control-Allow-Origin

Specifies which origins can access the resource. Can be a specific origin (https://trusted.com), wildcard (*), or null.

Access-Control-Allow-Credentials

Indicates whether cookies and authorization headers can be sent. Must be true (cannot use wildcard origin with credentials).

Access-Control-Allow-Methods

Specifies which HTTP methods are allowed (GET, POST, PUT, DELETE, etc.).

Access-Control-Allow-Headers

Lists which headers can be used in the actual request (e.g., Content-Type, Authorization).

Access-Control-Max-Age

How long (in seconds) preflight response can be cached. Recommended: 86400 seconds (24 hours) or less.

Simple vs Preflight Requests

CORS distinguishes between simple requests and preflight requests:

Simple Requests

Simple requests are sent directly without a preflight check. They must meet these conditions:

  • Method: GET, HEAD, or POST
  • Headers: Only Accept, Accept-Language, Content-Language, Content-Type (with limited values)
  • Content-Type: application/x-www-form-urlencoded, multipart/form-data, or text/plain

Preflight Requests

Preflight requests are triggered when a request doesn't meet "simple" criteria. The browser sends an OPTIONS request first to check permissions:

  1. Browser sends OPTIONS request with Access-Control-Request-Method and headers
  2. Server responds with allowed methods, headers, and origins
  3. If approved, browser sends the actual request
  4. Preflight response is cached based on Access-Control-Max-Age

Common CORS Vulnerabilities

🔴 Critical: Wildcard Origin with Credentials

Configuration: Access-Control-Allow-Origin: * + Access-Control-Allow-Credentials: true

Impact: Any website can make authenticated requests and steal user data, sessions, and credentials. This is the most severe CORS misconfiguration.

Attack: Attacker creates malicious website that uses victim's cookies to access your API and exfiltrate data.

Fix: Never use wildcard with credentials. Use explicit origin whitelist: Access-Control-Allow-Origin: https://trusted.com

🟠 High: Origin Reflection

Configuration: Server echoes any origin from request: Access-Control-Allow-Origin: $ORIGIN_HEADER

Impact: Bypasses origin validation entirely. Attackers can access resources from any domain.

Detection: Send request with Origin: https://evil.com - if server responds with same origin, it's vulnerable.

Fix: Validate origin against whitelist server-side before setting CORS headers. Never blindly reflect Origin header.

🟡 Medium: Null Origin Accepted

Configuration: Access-Control-Allow-Origin: null

Impact: Allows exploitation via sandboxed iframes or file:// protocol. Attackers can use <iframe sandbox> to generate null origin.

Attack: Malicious page creates sandboxed iframe that makes requests with null origin.

Fix: Never accept null origin. Only allow explicit trusted domains.

Security Best Practices

Use explicit origin whitelist

Maintain a list of trusted domains. Validate origin server-side against this list.

Never use wildcard with credentials

If credentials are needed, specify exact origin. Wildcard + credentials = critical vulnerability.

Restrict HTTP methods

Only allow necessary methods (GET, POST). Restrict PUT, DELETE, PATCH to authenticated origins.

Include Vary: Origin header

Prevents cache poisoning attacks. Tells caches to vary response based on Origin header.

Set reasonable Max-Age

Limit preflight cache to 24 hours (86400 seconds) or less for timely security updates.

Regular security audits

Audit CORS policies quarterly and after any API changes. Include in CI/CD pipeline.

Test before deployment

Use this tool and other security scanners to verify configuration before going live.

Frequently Asked Questions

Common questions about the CORS Policy Analyzer

CORS (Cross-Origin Resource Sharing) is a security mechanism that allows web servers to specify which origins (domains) can access their resources. It's implemented through HTTP headers and enforced by web browsers. CORS matters because misconfigured policies can lead to serious security vulnerabilities including data theft, session hijacking, and account takeover. According to recent security research, nearly 90% of API breaches begin with misconfigured CORS policies.

⚠️ Security Notice

This tool is provided for educational and authorized security testing purposes only. Always ensure you have proper authorization before testing any systems or networks you do not own. Unauthorized access or security testing may be illegal in your jurisdiction. All processing happens client-side in your browser - no data is sent to our servers.