Cross-Origin Resource Sharing is a browser mechanism where servers use Access-Control-* headers to permit or deny JavaScript on one website from reading responses fetched from another origin.

What is a CORS preflight request?

Browsers send an OPTIONS preflight before non-simple cross-origin requests to ask the server which methods, headers, and origins are permitted before sending the actual request.

What does Access-Control-Allow-Origin do?

It tells the browser which origins may read the response. A specific origin, null, or wildcard * are valid values with different security implications.

Why is Access-Control-Allow-Origin: * dangerous with credentials?

Browsers block this combination, but misconfigured servers that reflect origins while allowing credentials enable any website to read authenticated API data.

What is origin reflection in CORS?

Origin reflection occurs when a server returns Access-Control-Allow-Origin matching whatever Origin header the client sends, effectively allowing any website cross-origin access.

Do CORS headers protect against CSRF?

No. CORS controls response readability by JavaScript, not whether requests are sent. CSRF requires anti-CSRF tokens, SameSite cookies, or custom header requirements.

Which requests trigger CORS preflight?

Requests using methods other than GET, HEAD, or POST, POST with non-simple content types, or custom headers like Authorization typically trigger preflight OPTIONS.

What is Access-Control-Allow-Credentials?

When true, the browser includes cookies and authorization headers on cross-origin requests and requires a specific non-wildcard Access-Control-Allow-Origin value.

Can I test CORS on localhost APIs?

ScanSuite tests public URLs reachable from scan nodes. Expose staging APIs via HTTPS tunnels or deploy to a reachable staging domain for remote CORS validation.

How does CORS relate to Content-Security-Policy?

CSP connect-src restricts which origins JavaScript may fetch, while CORS controls whether responses are readable. Both layers should align for defense in depth.

What is Access-Control-Expose-Headers?

It lists response headers beyond the CORS-safelisted defaults that JavaScript is permitted to read via getResponseHeader().

Why do I see CORS errors in the browser but the checker shows headers?

Browser extensions, cached responses, or redirects may alter headers. Compare scan results with DevTools Network tab on a clean browser profile.

Should public APIs allow Access-Control-Allow-Origin: *?

Wildcard is acceptable for truly public read-only APIs without credentials, but explicit allowlists are safer when responses contain user-specific or sensitive metadata.

How often should I scan CORS configuration?

Scan after every API deployment, gateway migration, or CDN rule change, and include CORS checks in quarterly external security assessments.

Does CORS apply to server-to-server requests?

No. CORS is enforced only by browsers. Server-side HTTP clients ignore Access-Control headers entirely.

What is the Vary: Origin header?

It instructs caches to store separate responses per Origin, preventing a CDN from serving one origin's CORS header to a different origin.

Can CORS misconfiguration lead to data breaches?

Yes. Origin reflection on authenticated endpoints has been exploited to exfiltrate personal data, account details, and API tokens to attacker-controlled websites.

Is this CORS checker free?

Yes. ScanSuite provides unlimited free CORS scans on public URLs without registration or daily limits.

Free CORS Checker — Test Cross-Origin Config

A client-side CORS checker sends cross-origin fetch requests from the user's browser against a target URL, inspects Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Allow-Credentials response headers when the browser exposes them, and flags misconfigurations such as wildcard origins with credentials enabled or overly permissive method allowances.

Enter a public API or web app URL into ScanSuite's CORS checker and run the test. Your browser sends a cross-origin GET (with custom headers to trigger preflight) using this page's fixed Origin header, reporting which CORS headers are returned, whether credentials are permitted, and whether the target allows access from the ScanSuite origin.

Cross-Origin Resource Sharing (CORS) is a browser-enforced security mechanism that controls whether JavaScript running on one origin can read responses from another origin. Misconfigured CORS policies are among the most common API security flaws, frequently exposing sensitive user data to untrusted third-party websites through overly permissive Access-Control-Allow-Origin directives.

ScanSuite's free CORS checker runs entirely in your browser. It sends cross-origin requests from the ScanSuite page origin and reports Access-Control headers the browser exposes when the target allows this origin. HTTP targets cannot be tested from this HTTPS page due to mixed-content blocking.

ScanSuite's free CORS checker tests cross-origin resource sharing from your browser on any public HTTPS URL, analyzing Access-Control-Allow-Origin, credentials flags, and method exposure when headers are visible. Detect wildcard misconfigurations and understand whether the ScanSuite origin can read API responses.

Frequently Asked Questions

What is CORS?: Cross-Origin Resource Sharing is a browser mechanism where servers use Access-Control-* headers to permit or deny JavaScript on one website from reading responses fetched from another origin.
What is a CORS preflight request?: Browsers send an OPTIONS preflight before non-simple cross-origin requests to ask the server which methods, headers, and origins are permitted before sending the actual request.
What does Access-Control-Allow-Origin do?: It tells the browser which origins may read the response. A specific origin, null, or wildcard * are valid values with different security implications.
Why is Access-Control-Allow-Origin: * dangerous with credentials?: Browsers block this combination, but misconfigured servers that reflect origins while allowing credentials enable any website to read authenticated API data.
What is origin reflection in CORS?: Origin reflection occurs when a server returns Access-Control-Allow-Origin matching whatever Origin header the client sends, effectively allowing any website cross-origin access.
Do CORS headers protect against CSRF?: No. CORS controls response readability by JavaScript, not whether requests are sent. CSRF requires anti-CSRF tokens, SameSite cookies, or custom header requirements.