CORS Misconfiguration Scanner

Cross-Origin Resource Sharing (CORS) controls which domains can access your API. Misconfigured CORS policies — like reflecting arbitrary origins or allowing credentials with wildcards — can let attackers steal data from authenticated users through their browsers.

What This Scanner Does

Sends requests with various Origin headers to test how your server responds. Checks for wildcard origins with credentials, origin reflection, null origin acceptance, and overly permissive preflight responses across all discovered endpoints.

Why It Matters

A misconfigured CORS policy can let any website make authenticated requests to your API on behalf of your users. This can lead to data theft, unauthorized actions, and full account takeover — all without the user noticing.

Common Findings

• Origin header reflected without validation
• Wildcard (*) origin with Access-Control-Allow-Credentials
• Null origin accepted in CORS response
• Overly broad origin whitelist patterns

OWASP Top 10 Coverage

Related Security Checks