Tools / CORS policy

CORS policy checker

See how an endpoint responds to a cross-origin request and browser preflight, including whether it reflects arbitrary origins or allows credentials.

What it checks

Cross-origin GET response headers for a non-credentialed probe origin.
OPTIONS preflight response for a POST request with common headers.
Allowed origin, methods, headers, credentials, and Vary: Origin.

This is a passive header check, not an exploit. A permissive policy is not automatically a vulnerability; risk depends on the data and actions available from the endpoint.