CORS Misconfiguration Checker
Check whether a website's CORS policy is exposing authenticated data to arbitrary origins.
Sign in to run this scan
Free to use — we just ask you to sign in so scans stay fair for everyone.
How it works
CORS (Cross-Origin Resource Sharing) tells browsers which other websites are allowed to read a server's responses. This tool sends requests with a spoofed Origin header and checks whether the server reflects it back — the classic sign of a misconfiguration.
The riskiest pattern is an API that reflects any Origin AND allows credentials — that combination lets a malicious site read a logged-in user's private data through their own browser.
Frequently asked questions
My API returned no CORS headers at all — is that safe?
It means cross-origin browser requests to it will be blocked by default, which is safe from a CORS standpoint — but confirm that's intentional and not accidentally blocking a legitimate frontend that needs access.
Is reflecting the Origin header always a vulnerability?
For a fully public API with no authentication or cookies involved, it's low-risk. It becomes a real vulnerability specifically when combined with Access-Control-Allow-Credentials: true, which lets an attacker's site make authenticated requests using a victim's existing session.
Does a CORS misconfiguration affect server-to-server requests?
No — CORS is a browser-enforced restriction only. Server-to-server calls (via curl, a backend service, etc.) are never subject to CORS at all, which is a common point of confusion.
Related tools