CORS Configuration Checker

Instantly audit the CORS setup of any URL or API endpoint — and catch the misconfigurations that cause production bugs and security holes.

Live on the Apify Store — run it instantly or call it as an agent tool via Apify MCP.

What you get

For every endpoint, the actor sends a real cross-origin GET (with an Origin header) and an OPTIONS preflight (with Access-Control-Request-Method), then reads back the Access-Control-* headers and flags problems:

• allowOrigin / allowMethods / allowHeaders / allowCredentials — the exact CORS policy the server returns
• preflightOk — whether the OPTIONS preflight actually permits your origin
• issues — human-readable flags for the dangerous cases:
  • insecure wildcard * origin with credentials (browsers reject it — broken config)
  • reflects-any-origin — server echoes back any origin you send (open CORS)
  • missing-cors — no CORS headers at all
  • Access-Control-Allow-Origin: null exploit

Single URL or bulk (array / newline / comma-separated), with a configurable test origin.

Input

{
  "url": "https://api.github.com",
  "urls": ["https://example.com"],
  "origin": "https://example.com",
  "maxUrls": 25
}

Output

{
  "url": "https://api.github.com/",
  "origin": "https://example.com",
  "allowOrigin": "*",
  "allowMethods": "GET, POST, PATCH, PUT, DELETE",
  "allowHeaders": "Authorization, Content-Type",
  "allowCredentials": null,
  "preflightOk": true,
  "corsEnabled": true,
  "secure": true,
  "issues": [],
  "actual": { "status": 200, "allowOrigin": "*" },
  "preflight": { "status": 204, "allowOrigin": "*", "allowMethods": "GET, POST, PATCH, PUT, DELETE" }
}

Pricing: pay-per-event — $0.02 per URL checked.