ToolPuma Logo

CORS Checker

Analyze CORS headers for misconfigurations.

What Is a CORS Checker?

The CORS Checker analyzes Cross-Origin Resource Sharing headers to detect misconfigurations. It reviews Access-Control-Allow-Origin, Allow-Credentials, Allow-Methods, and Vary, and warns about risky patterns such as wildcard origins combined with credentials or missing Vary: Origin.

How to Use This CORS Checker

  1. 1
    Paste headersEnter the CORS-related response headers, one per line.
  2. 2
    Click AnalyzeThe tool evaluates each header.
  3. 3
    Read the findingsReview the warnings and whether the configuration is safe.

Frequently Asked Questions

CORS is a browser mechanism that controls whether a web page at one origin may request resources from another origin. It is configured with HTTP response headers.
Combining Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true is invalid in browsers. Using '*' with cognizance makes resources readable cross-origin.
When responses vary by origin, the Vary: Origin header prevents caches from serving a response for one origin to another, which could leak data.

Related Security & Privacy Tools

Password Generator

Generate strong random passwords with full control.

Random Password Generator

Create secure random passwords instantly.

Password Strength Checker

Evaluate how strong a password really is.

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-512 and SHA-3 hashes.

JWT Decoder

Decode the header and payload of a JWT token.

JWT Inspector

Decode a JWT and check exp, nbf and algorithm claims.

More Security & Privacy Tools

SSL Certificate Checker

Read and analyze the TLS certificate a server presents.

SSL Expiry Checker

See how many days remain until a certificate expires.

Security Headers Checker

Verify the presence of essential security headers.

HTTP Headers Analyzer

Fetch and inspect every response header of a URL.

CSP Checker

Review a Content Security Policy for risky directives.

Cookie Analyzer

Check cookies for Secure, HttpOnly and SameSite flags.