How to use CORS header analyser
Inspect pasted Access-Control response headers for wildcard, credential and cache pitfalls. The check runs when you submit the form. Its inputs are processed in this browser.
How the check works
Header lines are parsed without making a network request. The tool checks origin syntax, credentials, explicit null access and whether Vary includes Origin.
The Overview tab explains the findings. Measured data lets you search individual fields and values, while JSON report shows the complete export. Export JSON to retain a baseline, or print the findings for your own records. Review the report before sharing it: browser characteristics, token claims, and file names can reveal information about your setup.
Read the result in context
A wildcard origin cannot authorise a credentialed browser response. A specific origin with credentials can be valid, but the server must choose allowed origins deliberately.
Understand the limits
CORS is a browser response-reading policy, not server authentication. Preflight behavior, request credentials and dynamic origin reflection are not tested.
Common questions
Where is the input processed?
In this browser tab. This tool does not submit its input to the site server or a third-party service.
What should I keep with a result?
Record the selected options, browser and time. Review exported values before sharing them. Generated passwords, tokens and HMAC secret keys are excluded from report exports.