Understanding CORS
CORS controls which origins may read responses from browser JavaScript; it is not an authentication mechanism. Review Access-Control-Allow-Origin, credentials, methods and caching headers.
SIXHACK / WEB
CORS Analyzer
CORS response header analyzer
Analyze Access-Control response headers, credentials behavior, and Vary handling.
⇄CORS · API · Access Control
INPUT / 01
Input
OUTPUT / 02
Results
Results will appear here after processing the input.
HOW IT WORKS / GUIDE
Interpreting the results
Configurations worth checking
Reflected origins with credentials, the null origin, and dynamic policies without Vary: Origin deserve attention. Wildcard origin combined with credentials is rejected by browsers, not automatically exploitable.
Manual verification
Compare responses for multiple Origin values and determine whether authenticated sensitive data is exposed. This tool inspects pasted responses and never probes third-party servers.
NEXT / TOOLS