CORS Checker — check Cross-Origin headers

The service sends an OPTIONS preflight request and a GET request with the header Origin: https://101ip.ru and analyses the CORS headers in the server response.

Main CORS headers

• Access-Control-Allow-Origin — domains permitted to access (* — everyone);
• Access-Control-Allow-Methods — allowed HTTP methods (GET, POST, PUT, DELETE…);
• Access-Control-Allow-Headers — allowed request headers;
• Access-Control-Allow-Credentials — whether cookies and authorisation are permitted;
• Access-Control-Max-Age — preflight response cache time (seconds);
• Access-Control-Expose-Headers — headers accessible to client-side JS code.

Important: wildcard and credentials

The value Access-Control-Allow-Origin: * forbids the use of Allow-Credentials: true. The browser will block such a response. For authenticated requests, a specific origin must be specified.

When to use CORS Checker

• Diagnosing "CORS policy" errors in the browser;
• Checking settings of a public API or CDN;
• Security audit — wildcard can be a vulnerability.