CORS Policy Validator

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls which websites can make requests to your API. Without proper CORS configuration, your API could allow any malicious website to make authenticated requests using a visitor's cookies or credentials. A misconfigured CORS policy (like reflecting any Origin or using wildcard with credentials) effectively removes the browser's same-origin protection.

Simple requests (GET/HEAD/POST with only safelisted headers and content types) are sent directly — the browser checks the CORS headers on the response. Preflighted requests (DELETE, PUT, PATCH, or requests with custom headers) first send an OPTIONS request to check if the actual request is allowed. Your server must respond to OPTIONS with appropriate Access-Control-Allow-* headers. If the preflight fails, the actual request is never sent.

When you respond with Access-Control-Allow-Origin: *, any website can read your API responses. For truly public, read-only APIs this is fine. But combined with Access-Control-Allow-Credentials: true (which allows cookies/auth headers), browsers reject the combination. Attackers exploit misconfigured wildcard origins to perform CSRF-style attacks — they create pages that silently make API calls from victims' browsers. Always use specific origins for authenticated APIs.

By default, cross-origin requests don't include credentials (cookies, HTTP auth headers, client certificates). Setting this header to 'true' tells the browser to include them. This requires: a specific origin (not *), the client JavaScript to set 'credentials: include' on fetch or 'withCredentials: true' on XMLHttpRequest. Enabling this for an authenticated session API is common, but requires a carefully restricted Allow-Origin.

This header tells browsers how long to cache the preflight (OPTIONS) response in seconds. Without it, browsers send an OPTIONS request before every cross-origin request, adding latency. Set it to 600 (10 minutes) or 86400 (24 hours, the maximum browsers honor) to cache preflight results. Note: Chrome caps at 7200s (2 hours), Firefox at 86400s.

By default, JavaScript can only read a limited set of response headers (CORS-safelisted headers: Cache-Control, Content-Language, Content-Length, Content-Type, Expires, Last-Modified, Pragma). To expose custom headers like X-Request-ID, X-Rate-Limit-Remaining, X-Pagination-*, or Location, list them in Access-Control-Expose-Headers. Without this, fetch response.headers.get('X-Request-ID') returns null even if the header is present.