CORS exists so a server can explicitly opt certain other websites into reading its responses,
which browsers otherwise block by default (the same-origin policy). The server does this with
the Access-Control-Allow-Origin response header. A correct implementation checks the
request's Origin header against an explicit allow-list and either echoes back that
exact origin (if allowed) or omits the header (if not). A broken implementation just copies
whatever Origin it was sent straight into the response -- which looks identical to a
correct implementation for a legitimate visitor, and only shows up when someone sends an origin
that was never meant to be allowed.
A browser will only expose the response body to the requesting page's JavaScript when the
server's CORS headers say it's allowed. If the server reflects any origin, that
permission is meaningless -- every website on the internet passes the check. Combine that with
Access-Control-Allow-Credentials: true (which tells the browser to send the
visitor's cookies along with the cross-origin request) and an attacker's page can silently
request your API in the background, using the victim's own session, and read back whatever a
logged-in user could see.
| Pattern | What triggers it | Why it's exploitable |
|---|---|---|
| Reflects any origin | Origin: an unrelated made-up domain | No allow-list check is happening at all |
| Accepts Origin: null | Origin: null | A sandboxed iframe or a data: URI sends this automatically -- an attacker needs no domain of their own |
| Unanchored allow-list | Origin: a domain crafted to pass a naive startsWith/endsWith string check | An attacker can register a real domain that passes the check but isn't actually related to the allowed site |
The checker on this site sends six real requests -- these three plus a
baseline and a wildcard-with-credentials check -- and reports exactly which pattern, if any, your
API shows, with the response header that proves it. The requests come from a Node CLI you run
yourself against a system you own or are authorised to test; the browser page only renders a
report you paste in, since a browser tab cannot set the Origin header itself.
This is evidence from those six requests, not a full security assessment -- see the checker and its disclaimer for what it does and doesn't cover, and verify against a proper security review before treating a clean report as final.