Detect dangerous CORS policies that allow unauthorized third-party origins to invoke authenticated APIs.
Checks for Access-Control-Allow-Origin wildcard (*) with credentials allowed, dynamic reflection of arbitrary origin headers, and null origin bypasses.
Canonical test payload dispatched during security surface audits.
Origin: https://evil.attacker.com (returns ACAO: https://evil.attacker.com)Watch the probe engine test this signature in an isolated sandbox.
Whitelisted CORS Configuration
res.setHeader('Access-Control-Allow-Origin', req.headers.origin || '*');const ALLOWED = ['https://app.example.com'];
if (ALLOWED.includes(req.headers.origin)) {
res.setHeader('Access-Control-Allow-Origin', req.headers.origin);
}Enforce strict origin whitelisting rather than reflecting caller headers or allowing wildcards on authenticated endpoints.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for CORS Misconfiguration Scanner.
Checks commonly evaluated alongside CORS Misconfiguration Scanner during surface discovery.
Detect SQL injection vulnerabilities in your web application before attackers exploit database access.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.
Audit your site across all 41 vectors automatically on every deploy.