CORS Policy & Preflight Checker

A direct API/web preflight checker: target URLs and origin in, structured CORS policy evidence out, with optional regression comparison.

Why use this Actor

API and frontend teams need recurring evidence that CORS, credentialed origins, preflight, cache variation and Private Network Access policies remain safe across releases and gateways.

Key features

• Buyer-native inputs aligned to cors preflight.
• Predictable structured output in the default Apify Dataset.
• Pay Per Event pricing tied to measurable result rows or reports.
• Optional MCP connector delivery for downstream automation and AI agents.

Quick start

Start with this working example and replace the target values with your own:

{
  "urls": [
    "https://example.com"
  ],
  "testOrigin": "https://frontend.example",
  "requestedMethod": "POST",
  "requestHeaders": [
    "content-type"
  ],
  "failOnRisk": false
}

The Actor writes structured results to the default Apify Dataset and can be used from the Store, API, schedules, Tasks, automations and MCP-compatible AI workflows.

Input

• urls — Public URLs or API endpoints: Public HTTP(S) endpoints to audit.
• testOrigin — Primary test Origin: Origin header used for the primary simple request and preflight.
• additionalOrigins — Additional test origins: Optional additional origins used to reveal reflection or policy inconsistency. Up to three are used.
• requestedMethod — Preflight method: Method advertised in Access-Control-Request-Method.
• requestHeaders — Requested headers: Headers advertised in Access-Control-Request-Headers.
• previousSnapshots — Previous CORS snapshots: Optional previous snapshot objects keyed by input URL. Reuse the output snapshot field to detect exact policy drift.

All integration and advanced analysis fields are optional. The default example is intentionally runnable without configuring MCP or a previous-run baseline.

Output

The Dataset exposes predictable machine-readable output. Representative fields include dataset.

Pricing

This Actor uses Pay Per Event. The current factory base price is $0.001200 per result event. The Apify Store remains the source of truth for the price and plan/tier details shown to the buyer.

Use cases

• Run the buyer-ready workflows exposed as Apify Tasks without preparing a custom integration first.
• Use the Actor from API or schedules for recurring collection, comparison or monitoring.
• Feed the structured Dataset output into spreadsheets, databases, automations or AI agents.
• Compare repeat runs when the product supports snapshots or previous-run inputs.

Automation and AI

Use the same Actor through Apify API, schedules, public Tasks and the Apify MCP server. Outputs are structured for downstream workflows and AI agents rather than requiring manual copy/paste.

Limitations

• Public websites and upstream APIs can change markup, access rules, rate limits or field availability without notice.
• Fields that are not publicly available are returned as unavailable or omitted rather than fabricated.
• Analytical outputs depend on the quality and coverage of the supplied or collected source data.
• Treat marketplace, reputation, workforce, safety or commercial signals as decision support and validate material decisions against the underlying source evidence.

Detailed documentation

Give public URLs and an origin. Check CORS headers and preflight behavior, returning structured policy risks, evidence and compatibility issues.

Why use this Actor

CORS problems often appear only after a gateway, CDN, framework or reverse-proxy change. A homepage GET is not enough. This Actor compares simple and preflight behavior so API teams can see what the server actually tells browsers for a chosen Origin, method and request-header set.

Key features

• Sends a simple request with Origin and a matching OPTIONS preflight.
• Tests a primary Origin plus up to three additional origins.
• Inspects Access-Control-Allow-Origin, credentials, methods, headers, exposed headers, max-age and Vary: Origin.
• Detects wildcard-with-credentials, reflected origins without Vary, null-origin credential risk, method/header inconsistencies and preflight errors.
• Produces normalized severity findings, score and agentAction for automation.
• Emits a reusable snapshot with SHA-256 fingerprint.
• Accepts previousSnapshots to report exact policy drift between runs.
• Optional failOnRisk writes evidence first and then fails the run for CI/CD gating.
• 256 MB deterministic HTTP runtime. No browser, external AI service or paid security API.

Input example

{
  "urls": ["https://api.example.com/v1/data"],
  "testOrigin": "https://app.example.com",
  "additionalOrigins": ["https://partner.example.com"],
  "requestedMethod": "POST",
  "requestHeaders": ["authorization", "content-type"],
  "failOnRisk": false
}

Drift monitoring

Store the snapshot object from a result and pass it on a later run inside previousSnapshots, keyed by the input URL. The Actor reports policyChanged, field-level changes, and the new fingerprint. This is useful for scheduled monitoring of gateways, CDNs and API releases.

CI/CD gate

Set failOnRisk: true and optionally adjust minimumScore. Evidence is written to the dataset before the run fails, so release pipelines retain the reason for the block.

Output

Each endpoint produces one dataset row containing status, score, maximum severity, simple/preflight status, observed CORS policy, structured findings, tested origins, snapshot, drift evidence and recommended agent action.

Pricing

Planned pricing remains $0.0012 USD per audited endpoint. Multiple HTTP probes are internal evidence collection and do not create extra billable events.

Limitations

• CORS behavior can vary by authentication state, cookies, endpoint path and application-specific origin logic.
• This Actor audits public unauthenticated behavior and does not perform exploitation or penetration testing.
• Some endpoints intentionally reject OPTIONS requests; those responses are preserved as evidence.

Use cases

• API release gates and CI/CD checks.
• API gateway, CDN and reverse-proxy validation.
• Frontend cross-origin debugging.
• Security review evidence for public endpoints.
• Scheduled CORS configuration-drift monitoring.
• Migration and framework-upgrade QA.

Scope and safety

Only public HTTP(S) targets are accepted. Private, loopback, link-local and reserved destinations are rejected and redirects are revalidated. The Actor is a configuration auditor, not an exploitation or penetration-testing tool.

Input reliability — 25 October 2026

Target lists are validated before network work, trimmed and deduplicated. Empty lists and malformed baselines are rejected rather than silently auditing a default website. Exact duplicate targets produce one result. Existing output fields and prices are preserved.