CORS गलत कॉन्फ़िगरेशन चेकर
Overly open CORS can let other sites read data from your users' sessions. Test the common mistakes safely.
और गहराई सेआप आगे क्या पता लगाना चाहते हैं?
What this tool checks
- Whether arbitrary origins are reflected
- The null origin
- Wildcard origin combined with credentials
- Origin matching bypasses (prefix and suffix)
- Preflight methods and headers
- Vary: Origin
How to read the result
The tool only sends harmless GET and OPTIONS requests with test origins. "No CORS headers" is the secure default for pages that should not be read by other sites.
शब्दों की व्याख्या
अक्सर पूछे जाने वाले प्रश्न
Is a wildcard origin always bad?
Not for fully public, unauthenticated data. It is dangerous together with credentials or private data.
What is the safest approach?
Allow only an explicit list of trusted origins and send Vary: Origin.
Does this test my login endpoints?
It tests the URL you enter. Check your authenticated API URLs too.