CORS Security Checker

Cross-Origin Resource Sharing (CORS) is a security mechanism built into modern web browsers. It restricts web applications from making request resources to a different domain than the one that served the page, unless the target server explicitly permits it. Auditing CORS rules helps prevent unauthorized cross-domain data reading.

If a server configures Access-Control-Allow-Origin to "*" and allows credentials (Access-Control-Allow-Credentials: true), malicious third-party websites can perform authenticated API requests on behalf of users, capturing sensitive sessions or credentials.

Avoid reflecting dynamic Origin request headers in the Allow-Origin response without validating against a strict whitelist of trusted hosts. If credentials sharing is required, configure a specific, trusted origin value instead of the wildcard (*).