Browser API CORS Allowlist and Credential Exposure Gate
Pricing
from $10.00 / 1,000 cors gate run starts
Sends a real OPTIONS preflight and a real cross-origin GET from each origin that you name, against each API path that you name. Reports which origins the API accepts, which accept credentials, and every violation class: wildcard with credentials, origin r
The base URL of an API that you own, or that you are authorized to test. The Actor joins each path to this base URL. Private, loopback and reserved addresses are refused.
1 to 25 endpoint paths, for example /v1/account and /v1/orders. Every path is probed from every origin.
[ "/", "/rate_limit"]The origins of your own browser applications, for example https://app.example.com. An origin of this list that the API refuses gives the violation class allow_list_origin_refused.
[ "https://app.example.com"]The origins that the API must never accept. The value null is a real origin value that a sandboxed frame sends. An origin of this list that the API accepts gives the violation class deny_list_origin_accepted.
[ "https://evil.example.com", "null", "http://attacker.example"]Add https://cors-probe. to the deny list. A gateway that matches the host with a loose suffix rule accepts that origin, and an attacker who takes one subdomain then reads your API.
The methods that your application uses. The first method is named in Access-Control-Request-Method. Every method is compared against Access-Control-Allow-Methods. The Actor itself sends only OPTIONS and GET, so it never changes data.
[ "GET", "POST", "PUT", "DELETE"]The header names that your application sends. They are named in Access-Control-Request-Headers and compared against Access-Control-Allow-Headers.
[ "authorization", "content-type"]Store the verdict of each origin and path pair in the key-value store, and report every change in the next run. The first run writes the matrix and reports no diff.
Leave this empty to derive the record key from the base URL. Set it to keep more than one matrix for the same API, for example one for staging and one for production.
The Actor stops one request after this time.
How many origin and path pairs the Actor probes at the same time.
A hard bound on the run. Each pair costs two requests, and each confirmed reflection costs two more. A pair above the bound is reported as skipped.