Access-Control-Allow-Origin
Identifies an origin allowed to read the response. A wildcard permits any origin for non-credentialed CORS requests.
Access-Control-Allow-Origin: https://app.example.com
DeployPass / CORS Checker
Free · No signup · Public endpoint checkFree CORS Checker
Test the CORS configuration of a public website or API endpoint. Inspect Access-Control-Allow-Origin, credentials, allowed methods, allowed headers and preflight response signals.
DeployPass sends a test Origin and a standard OPTIONS preflight request when possible. Results describe the tested public endpoint, not every route in an application.
Testing CORS response behavior…
CORS CONFIG SCORE
—/100
REVIEWCross-origin response review
—Allowed origin
—Credentials
—Methods
—Preflight
Understand the result
CORS controls which browser origins may read a response.
Cross-Origin Resource Sharing is an HTTP-header mechanism used by browsers. A broad policy can be intentional for public APIs, while credentialed endpoints usually need a carefully restricted origin policy.
Credentials
Access-Control-Allow-Credentials allows browser credentials such as cookies to participate when the rest of the CORS policy also permits the request.
Access-Control-Allow-Credentials: true
Preflight requests
Browsers can send OPTIONS before non-simple cross-origin requests to ask which methods and request headers are permitted.
Access-Control-Request-Method: GET
Vary: Origin
When a server dynamically returns different allowed origins, Vary: Origin helps shared caches keep responses for different origins separate.
Vary: Origin
Interpret carefully
“No CORS” is not automatically a problem.
Many normal websites do not need to expose responses to other browser origins. Likewise, a wildcard policy can be appropriate for a deliberately public, non-credentialed API. DeployPass highlights observable configuration and risky combinations rather than treating every broad policy as a vulnerability.
FAQ
CORS checker FAQ
What does a CORS checker test?
It sends cross-origin-style requests to a public endpoint and reviews CORS response headers such as Access-Control-Allow-Origin, credentials, methods and allowed headers.
Is Access-Control-Allow-Origin: * insecure?
Not necessarily. It is common for intentionally public resources. It deserves more scrutiny when sensitive data or credentialed access is involved.
Why does the tool send an Origin header?
CORS behavior can depend on the requesting origin. DeployPass uses a fixed test origin so it can observe whether the server denies, allows broadly, or reflects that origin.
What is a CORS preflight?
A preflight is an OPTIONS request browsers use before certain cross-origin requests to check which methods and headers the server permits.
Does one result cover my whole API?
No. CORS can differ by route, method, authentication state and environment. Test the specific public endpoints that matter.