CORS Policy Analyzer

About this tool

One response cannot show a CORS flaw, because the interesting part is how the answer changes with the Origin you send. This tool takes several probe results that you captured yourself from a target you are allowed to test: for each probe the Origin you sent, optionally the preflight request method and headers, and the response headers (a raw HTTP response, curl -i output, or just the header lines). The Show me which probes to run button writes the curl commands for a domain you type: an arbitrary origin, null, a prefix variant (https://target.evil.example), a suffix variant (https://eviltarget), a subdomain, the http version of the site, the site itself and one preflight. The tool never sends them; it only prints text. For every probe it states whether a browser would let JavaScript on that origin read the response, without and with cookies, following the Fetch standard CORS check: Access-Control-Allow-Origin must be * (only without credentials) or exactly equal the request origin, and with credentials Access-Control-Allow-Credentials must be exactly the lowercase word true. Several header lines, comma lists, trailing slashes and different letter case all fail. For preflights it also checks the status, the allowed method and the allowed headers, where * does not work with credentials. The verdicts were compared with headless Chrome 153 on 79 test cases, each with and without credentials; where the standard and Chrome differ Chrome was followed and the result carries a note. The one known difference: Chrome accepts * in Access-Control-Allow-Headers for the authorization header, while the standard says * never covers it. Findings are rated critical to info with an explanation and a fix: a reflected origin (critical with credentials), the null origin, wildcard with credentials (reported as ineffective, not exploitable), a wildcard that may expose non-public data, prefix, suffix and regex bypasses, an http origin trusted by an https site, trusting all subdomains, a missing Vary: Origin when the answer changes with the Origin, over-broad allowed methods and headers, Private Network Access, a Max-Age above the browser caps (Chrome 7200 seconds, Firefox 86400), a wildcard in Expose-Headers, invalid Access-Control-Allow-Origin values and Timing-Allow-Origin. A single probe set cannot tell whether a wildcard response is public; the finding says what to verify.

How to use it

1. Type the target URL or domain and press Show me which probes to run, then run the curl commands against a target you are authorised to test.
2. Paste each result under a line like ### Origin: https://evil.example (use the paste layout button for the exact format).
3. Press Analyze and read the browser verdict table and the findings.
4. Fix the critical and high findings first, then run the same probes again to confirm.

Common problems

It says no target was given or guesses a wrong one

Fill in the target field with the host you probed. It is used to tell the site itself, its subdomains and look-alike origins apart.

Credentials are allowed with * but I see no browser error

Browsers refuse that combination for credentialed requests, so it does not leak cookies. The tool reports it as a low, ineffective setting; unauthenticated reads still work.

My response was skipped or shows no headers

Paste the raw response or curl -i output under the ### line. Only header lines of the last response are read, so redirects before it are fine.