HTTP CORS Security Headers Auditor
Audits Cross-Origin Resource Sharing (CORS) response headers for insecure wildcard configurations.
Notice: engineering verification utility. Use test or de-identified data and verify results independently before relying on them.
How it works
Standard: W3C Cross-Origin Resource Sharing Recommendation
Formula: Check Access-Control-Allow-Origin for wildcard '*' combined with credentials
Checks: Header value verification
Calculated locally in browser memory; nothing leaves your browser.
Deterministic local-first client-side execution. Provided as-is without warranty.