Free CORS misconfiguration checker
CORS headers decide which other websites may read your responses from a visitor's browser. Enter a page or an API URL to see whether any site can read it, including with your users' cookies.
What this checks
- One normal GET request to the URL you enter, sent with
Origin: https://cors-check.sniffpup.com(a site we control that you'd never allow on purpose). - Reflected origins: if
Access-Control-Allow-Origincopies our origin back, any website can read this URL. WithAccess-Control-Allow-Credentials: trueas well, it can read it as your signed-in users. - The
nullorigin: allowingnulllets sandboxed pages and local files read your responses. - Wildcard:
*without credentials is reported as normal for public content.
What it can't tell you
- It checks the one URL you enter. Your API routes can have different rules than your home page, so check the routes that return user data.
- It sends a plain GET, not a preflight (OPTIONS) request, so rules that only apply to other methods aren't tested.
- It can't sign in, so routes that only send CORS headers to signed-in requests may look fine here.
- It checks live web URLs only, not native mobile apps or pages behind a login.
- No issues found means none in this one check at that moment. It is never proof of security.
Check it yourself
From a terminal, using your own URL:
curl -s -D - -o /dev/null -H "Origin: https://example.org" https://api.your-app.com/me | grep -i '^access-control'
If access-control-allow-origin: https://example.org comes back, your server trusts any origin. With access-control-allow-credentials: true too, that's serious.
How to fix it
- Replace "echo the request's Origin" with an allowlist of your own domains, and send
Vary: Origin. - Only send
Access-Control-Allow-Credentials: truefor origins on that list, never with a reflected ornullorigin. - Redeploy, then check the same URL again.
This checker answers one question. The free scan checks everything at once, and how our scanner works explains what it does and never does.
Questions
Is Access-Control-Allow-Origin: * dangerous?
Not on its own. Browsers never send cookies with a * response, so it's fine for public data. It's a problem only if the URL returns private data based on something other than cookies, like the visitor's network.
What does a reflected origin mean?
Your server copied whatever Origin it was sent into Access-Control-Allow-Origin. That lets any website read the response from a visitor's browser, and with credentials allowed, as that signed-in visitor.
Which URL should I check?
An API route that returns something private when you're signed in, like a profile or account endpoint. Your home page usually doesn't send CORS headers at all.