CORS Misconfiguration & Origin Security Checker
Audit API preflight headers. Detect arbitrary origin reflections, wildcard leaks with credentials, and dangerous null-origin trust policies.
Simulates preflight OPTIONS and GET requests with arbitrary Origin headers. Authorized testing only.
$ curl -sI -H "Origin: https://attacker.com" https://api.example.com/v1/user
[PASS] Access-Control-Allow-Origin: Not reflected for untrusted origin
[PASS] Access-Control-Allow-Credentials: Not enabled with wildcard
[PASS] Null origin test: Server returned 403 Forbidden
[STATUS] Clean: Strong Origin Allowlist Enforced
REST API & CORS Defense
Read our complete architectural guide to securing APIs against CORS wildcards, BOLA, and IDOR.
Prioritize by Business Impact
Calculate real risk for origin misconfigurations based on data sensitivity and exploit paths.
Upgrade from Single-Check to Automated DAST Vulnerability Scanner
Full-scale active fuzzing for OWASP Top 10, SQLi, XSS, SSRF & BOLA. Scale with automated schedules, Slack alerts, 150+ monthly credits, and compliance PDF exports on our paid tiers.
Frequently Asked Questions
What is a CORS misconfiguration and why is it dangerous?
Cross-Origin Resource Sharing (CORS) relaxes the browser's Same-Origin Policy. If an API dynamically reflects arbitrary origin headers or serves Access-Control-Allow-Origin: * paired with Access-Control-Allow-Credentials: true, malicious third-party websites can send authenticated cross-origin requests and read private user data.
Why is Access-Control-Allow-Origin: null dangerous?
Browsers assign the 'null' origin to sandboxed iframes, local file schemes, and data: URIs. If a server trusts the 'null' origin, an attacker can embed your application in a sandboxed iframe to bypass CORS protections and exfiltrate responses.
Does CORS protect backend servers against unauthorized requests?
No. CORS is strictly a browser-enforced mechanism that prevents unauthorized web scripts from reading server responses. It does not stop non-browser clients (such as curl or Python scripts) from sending HTTP requests. Servers must always validate authentication tokens independently.
How can I configure CORS securely in production?
Explicitly allowlist specific trusted origins (e.g. `https://app.yourdomain.com`), avoid regex matching without anchors, never reflect the incoming Origin header blindly, and avoid using `credentials: true` unless strictly required for authenticated cookies.