# CORS Headers & Preflight Checker | URL Audit (`quanmatrix/cors-policy-auditor`) Actor

Test public URLs with configured origins and HTTP methods to inspect CORS headers, preflight responses and potential cross-origin policy risks.

- **URL**: https://apify.com/quanmatrix/cors-policy-auditor.md
- **Developed by:** [Rafael Barreto Haddad](https://apify.com/quanmatrix) (community)
- **Categories:** Developer tools, Automation
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.94 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CORS Policy & Preflight Checker

A direct API/web preflight checker: target URLs and origin in, structured CORS policy evidence out, with optional regression comparison.

### Why use this Actor

API and frontend teams need recurring evidence that CORS, credentialed origins, preflight, cache variation and Private Network Access policies remain safe across releases and gateways.

### Key features

- Buyer-native inputs aligned to **cors preflight**.
- Predictable structured output in the default Apify Dataset.
- Pay Per Event pricing tied to measurable result rows or reports.
- Optional MCP connector delivery for downstream automation and AI agents.

### Quick start

Start with this working example and replace the target values with your own:

```json
{
  "urls": [
    "https://example.com"
  ],
  "testOrigin": "https://frontend.example",
  "requestedMethod": "POST",
  "requestHeaders": [
    "content-type"
  ],
  "failOnRisk": false
}
```

The Actor writes structured results to the default Apify Dataset and can be used from the Store, API, schedules, Tasks, automations and MCP-compatible AI workflows.

### Input

- `urls` — Public URLs or API endpoints: Public HTTP(S) endpoints to audit.
- `testOrigin` — Primary test Origin: Origin header used for the primary simple request and preflight.
- `additionalOrigins` — Additional test origins: Optional additional origins used to reveal reflection or policy inconsistency. Up to three are used.
- `requestedMethod` — Preflight method: Method advertised in Access-Control-Request-Method.
- `requestHeaders` — Requested headers: Headers advertised in Access-Control-Request-Headers.
- `previousSnapshots` — Previous CORS snapshots: Optional previous snapshot objects keyed by input URL. Reuse the output snapshot field to detect exact policy drift.

All integration and advanced analysis fields are optional. The default example is intentionally runnable without configuring MCP or a previous-run baseline.

### Output

The Dataset exposes predictable machine-readable output. Representative fields include `dataset`.

### Pricing

This Actor uses Pay Per Event. The current factory base price is **$0.001200 per result event**. The Apify Store remains the source of truth for the price and plan/tier details shown to the buyer.

### Use cases

- Run the buyer-ready workflows exposed as Apify Tasks without preparing a custom integration first.
- Use the Actor from API or schedules for recurring collection, comparison or monitoring.
- Feed the structured Dataset output into spreadsheets, databases, automations or AI agents.
- Compare repeat runs when the product supports snapshots or previous-run inputs.

### Automation and AI

Use the same Actor through Apify API, schedules, public Tasks and the Apify MCP server. Outputs are structured for downstream workflows and AI agents rather than requiring manual copy/paste.

### Limitations

- Public websites and upstream APIs can change markup, access rules, rate limits or field availability without notice.
- Fields that are not publicly available are returned as unavailable or omitted rather than fabricated.
- Analytical outputs depend on the quality and coverage of the supplied or collected source data.
- Treat marketplace, reputation, workforce, safety or commercial signals as decision support and validate material decisions against the underlying source evidence.

### Detailed documentation

Give public URLs and an origin. Check CORS headers and preflight behavior, returning structured policy risks, evidence and compatibility issues.

### Why use this Actor

CORS problems often appear only after a gateway, CDN, framework or reverse-proxy change. A homepage GET is not enough. This Actor compares simple and preflight behavior so API teams can see what the server actually tells browsers for a chosen Origin, method and request-header set.

### Key features

- Sends a simple request with `Origin` and a matching `OPTIONS` preflight.
- Tests a primary Origin plus up to three additional origins.
- Inspects `Access-Control-Allow-Origin`, credentials, methods, headers, exposed headers, max-age and `Vary: Origin`.
- Detects wildcard-with-credentials, reflected origins without `Vary`, null-origin credential risk, method/header inconsistencies and preflight errors.
- Produces normalized severity findings, score and `agentAction` for automation.
- Emits a reusable `snapshot` with SHA-256 fingerprint.
- Accepts `previousSnapshots` to report exact policy drift between runs.
- Optional `failOnRisk` writes evidence first and then fails the run for CI/CD gating.
- 256 MB deterministic HTTP runtime. No browser, external AI service or paid security API.

### Input example

```json
{
  "urls": ["https://api.example.com/v1/data"],
  "testOrigin": "https://app.example.com",
  "additionalOrigins": ["https://partner.example.com"],
  "requestedMethod": "POST",
  "requestHeaders": ["authorization", "content-type"],
  "failOnRisk": false
}
```

### Drift monitoring

Store the `snapshot` object from a result and pass it on a later run inside `previousSnapshots`, keyed by the input URL. The Actor reports `policyChanged`, field-level `changes`, and the new fingerprint. This is useful for scheduled monitoring of gateways, CDNs and API releases.

### CI/CD gate

Set `failOnRisk: true` and optionally adjust `minimumScore`. Evidence is written to the dataset before the run fails, so release pipelines retain the reason for the block.

### Output

Each endpoint produces one dataset row containing status, score, maximum severity, simple/preflight status, observed CORS policy, structured findings, tested origins, snapshot, drift evidence and recommended agent action.

### Pricing

Planned pricing remains **$0.0012 USD per audited endpoint**. Multiple HTTP probes are internal evidence collection and do not create extra billable events.

### Limitations

- CORS behavior can vary by authentication state, cookies, endpoint path and application-specific origin logic.
- This Actor audits public unauthenticated behavior and does not perform exploitation or penetration testing.
- Some endpoints intentionally reject OPTIONS requests; those responses are preserved as evidence.

### Use cases

- API release gates and CI/CD checks.
- API gateway, CDN and reverse-proxy validation.
- Frontend cross-origin debugging.
- Security review evidence for public endpoints.
- Scheduled CORS configuration-drift monitoring.
- Migration and framework-upgrade QA.

### Scope and safety

Only public HTTP(S) targets are accepted. Private, loopback, link-local and reserved destinations are rejected and redirects are revalidated. The Actor is a configuration auditor, not an exploitation or penetration-testing tool.

#### Input reliability — 25 October 2026

Target lists are validated before network work, trimmed and deduplicated. Empty lists and malformed baselines are rejected rather than silently auditing a default website. Exact duplicate targets produce one result. Existing output fields and prices are preserved.

# Changelog

This Actor's version history is a separate document: https://apify.com/quanmatrix/cors-policy-auditor/changelog.md

# Actor input Schema

## `urls` (type: `array`):

Public HTTP(S) endpoints to audit. Exact duplicates are processed once; empty target arrays are rejected.

## `testOrigin` (type: `string`):

Origin header used for the primary simple request and preflight.

## `additionalOrigins` (type: `array`):

Optional additional origins used to reveal reflection or policy inconsistency. Up to three are used.

## `requestedMethod` (type: `string`):

Method advertised in Access-Control-Request-Method.

## `requestHeaders` (type: `array`):

Headers advertised in Access-Control-Request-Headers.

## `previousSnapshots` (type: `object`):

Optional previous snapshot objects keyed by input URL. Reuse the output snapshot field to detect exact policy drift.

## `failOnRisk` (type: `boolean`):

After writing evidence, fail the run when a high/critical finding or score below minimumScore is observed. Useful for CI/CD.

## `minimumScore` (type: `number`):

Score threshold used when failOnRisk is enabled.

## `maxUrls` (type: `integer`):

Maximum URLs processed in this run.

## `concurrency` (type: `integer`):

Maximum endpoints audited in parallel.

## `timeoutSecs` (type: `integer`):

Timeout per HTTP request.

## `testPrivateNetwork` (type: `boolean`):

Send the Private Network Access preflight request header and flag unsafe allowance for reflected or credentialed origins.

## `mcpConnectors` (type: `array`):

Optional MCP connectors authorized in your Apify account. Use them to send or write this Actor result to tools such as Slack, Notion, GitHub, Sentry, Supabase, or another compatible MCP service.

## `mcpToolName` (type: `string`):

Optional exact MCP tool name. Leave blank to let the selected MCP action preset discover a compatible tool automatically.

## `mcpToolArguments` (type: `object`):

JSON object passed to the selected MCP tool. String values may use {{actor_title}}, {{result_summary}}, or {{result_json}} placeholders.

## `mcpFailOnError` (type: `boolean`):

When enabled, an MCP delivery error fails the Actor run. Disabled by default so data extraction and intelligence results remain available even if the external destination is unavailable.

## `mcpActionPreset` (type: `string`):

Choose a safe action pattern. AUTO_SAFE_WRITE discovers a compatible non-destructive write tool automatically; use a specific preset for Slack, GitHub, Notion, or database delivery.

## Actor input object example

```json
{
  "urls": [
    "https://example.com"
  ],
  "testOrigin": "https://cors-audit.example",
  "additionalOrigins": [],
  "requestedMethod": "POST",
  "requestHeaders": [
    "content-type"
  ],
  "previousSnapshots": {},
  "failOnRisk": false,
  "minimumScore": 70,
  "maxUrls": 50,
  "concurrency": 5,
  "timeoutSecs": 20,
  "testPrivateNetwork": false,
  "mcpToolName": "",
  "mcpToolArguments": {},
  "mcpFailOnError": false,
  "mcpActionPreset": "AUTO_SAFE_WRITE"
}
```

# Actor output Schema

## `dataset` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("quanmatrix/cors-policy-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("quanmatrix/cors-policy-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call quanmatrix/cors-policy-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,quanmatrix/cors-policy-auditor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/bsgQON4dVELf2zsjy/builds/KVxNfU6YLX05Pm5IB/openapi.json