How do I capture the right headers?

CORS decisions are made on the response to both preflight (OPTIONS) and actual requests. Paste headers from both if you can — or run: curl -sI -H 'Origin: https://evil.example' -X OPTIONS .

Yes — for genuinely public, unauthenticated data (public APIs, CDN assets, open datasets). It's a problem only when the endpoint serves user-specific or authenticated content.

The checker says my reflected origin is a warning, not a fail?

Reflection itself isn't proof of a bug — if your allowlist check happens before reflection you're fine. It's flagged because it's where real-world CORS bugs hide; verify the allowlist exists and that Vary: Origin is set.

CORS Misconfiguration Checker — Dangerous Combinations

Paste your API's CORS response headers and detect dangerous setups: wildcard origins with credentials, null-origin acceptance, reflected origins and missing Vary: Origin.

Response headers containing Access-Control-*From DevTools → Network, or curl -sI -H 'Origin: https://example.com' <endpoint>. Everything runs locally in your browser — pasted content is never uploaded, logged or stored.

Waiting

Paste content above

The tool runs instantly, entirely in your browser.

Last reviewed 2026-10-19. Rates change — verify against the official sources linked below before relying on these figures.

What this is based on

Detects: wildcard+credentials, null origin, reflected origin with credentials, credentials without ACAO, wildcard allow-headers, and missing Vary: Origin on dynamic ACAO.
Everything runs locally in your browser — pasted content is never uploaded, logged or stored.

PortSwigger — CORS vulnerabilities ↗Free CLI version on GitHub ↗Full CORS audit agent skill ↗

The combination that actually bites

A single permissive header is rarely the problem — it's the combination. Access-Control-Allow-Origin: * alone is fine for public data. But pairing a reflected origin with Access-Control-Allow-Credentials: true means any website can make authenticated requests on behalf of your users and read the responses.

The sneakiest variant is Origin reflection: the server copies whatever Origin the request sends into ACAO. If credentials are also allowed, the CORS policy is effectively absent — every origin becomes trusted.

Why Vary: Origin matters

When ACAO is dynamic (different origins get different answers), caches — both browsers' and CDNs' — can store and replay a response meant for one origin to another. Vary: Origin tells caches to key the entry by origin, preventing one visitor's permissive response from being served to everyone.

Frequently asked questions

How do I capture the right headers?: CORS decisions are made on the response to both preflight (OPTIONS) and actual requests. Paste headers from both if you can — or run: curl -sI -H 'Origin: https://evil.example' -X OPTIONS <endpoint>.
Is ACAO: * ever OK?: Yes — for genuinely public, unauthenticated data (public APIs, CDN assets, open datasets). It's a problem only when the endpoint serves user-specific or authenticated content.
The checker says my reflected origin is a warning, not a fail?: Reflection itself isn't proof of a bug — if your allowlist check happens before reflection you're fine. It's flagged because it's where real-world CORS bugs hide; verify the allowlist exists and that Vary: Origin is set.

Related calculators

Security Headers Checker

Paste HTTP response headers and instantly see which security headers are missing — HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy — plus cookie flag and Server version checks.

JWT Decoder

Paste a JWT and instantly see its header, claims and expiry — decoded entirely in your browser. No upload, no sign-up, nothing leaves your device.

Secret Leak Scanner

Paste code or a git diff and detect leaked credentials — AWS keys, GitHub and Slack tokens, private key blocks, hardcoded API keys and JWTs. Matched values are masked, never displayed.