← CORS misconfiguration checker
Burp Suite, from PortSwigger, is one of the best-known tools in web application security. It is a testing platform built around an intercepting proxy: you route a browser through it, watch and modify the traffic, and replay or vary individual requests by hand with tools such as Repeater and Intruder. PortSwigger distributes it in a free Community Edition and in paid editions that add automated vulnerability scanning, and it publishes a large body of free learning material — including its Web Security Academy topic on CORS, which is where several of the attack shapes this checker probes for are documented in the first place.
That is a much bigger job than the one this page does, and a different shape of job.
This checker is a single zero-dependency Node command. It sends
six ordinary GET requests to one URL you name, each with a different
Origin header, and classifies the responses into four named CORS misconfiguration
patterns — a reflected unrelated origin, an accepted Origin: null, and two
unanchored allow-list bypass shapes — plus notices for wildcard-with-credentials and a dynamic
Access-Control-Allow-Origin missing Vary: Origin. It names the exact
response header behind each finding and exits non-zero when a danger-severity finding is
produced. It has no proxy, no browser integration, no scanner, and no opinion about any
vulnerability class other than CORS.
| What you are trying to do | Where to do it |
|---|---|
| Assess a whole web application, explore it interactively, work through authenticated flows, and chain findings together. | Burp Suite or a comparable web security testing platform — none of that is something this checker attempts. |
Find out whether this one endpoint reflects an arbitrary origin, accepts Origin: null, or has an unanchored allow-list check. |
This checker — one command, six requests, a report naming the header that proves it. |
| Gate a deploy in CI on a CORS regression, unattended, on a runner with no GUI and no licence key. | This checker — zero dependencies, exit code 1 on a danger finding. |
| Build a working proof of concept for a bug report, or test how a finding behaves with real session credentials. | Burp Suite — this checker sends unauthenticated GETs only and produces no exploit. |
| Scan for the wide catalogue of web vulnerability classes that are not CORS at all. | Burp Suite's scanner, in the editions that include it, or another scanner — this checker looks at CORS and nothing else. |
| Understand the attack classes before testing for them. | PortSwigger's Web Security Academy CORS material is free and excellent; this checker's own background page covers the same three patterns in short form. |
These compose rather than compete. A reasonable setup is this checker wired into your own CI against your own staging environment, so an allow-list change that reintroduces a reflected origin turns a build red the day it lands, and a real assessment — with Burp Suite or with a person you hire — for everything a six-request check cannot see. Neither one makes the other redundant.
They do different jobs, and most people testing an API seriously will end up wanting both. Burp Suite, from PortSwigger, is a general-purpose web security testing platform built around an intercepting proxy: you route a browser through it, explore the application, and replay or vary individual requests by hand with tools like Repeater and Intruder, with automated vulnerability scanning available in its paid editions. It covers a very broad catalogue of web vulnerability classes, of which CORS is one. This checker covers nothing but CORS. It is a single zero-dependency Node command that sends six GET requests with different Origin headers to one URL, classifies the responses into four named misconfiguration patterns plus two notices, names the exact response header behind each, and exits non-zero on a danger finding. Reach for Burp Suite when you are assessing a whole application, working through authenticated flows, or building a proof of concept. Reach for this when you want that one CORS question answered repeatably, in CI, on a machine with no GUI and no licence.
Being free is not the difference, and this page does not claim it is: PortSwigger publishes a free Community Edition of Burp Suite, and its Web Security Academy material on CORS attacks is free to read as well. The differences that matter here are shape and scope. Burp Suite is a desktop application you install, launch, and drive interactively through a proxy; automated and scheduled scanning is what its paid editions are for. This checker is one command with no install beyond Node, no licence key, no proxy configuration, and no interactive step, so it runs unattended on a CI runner and gates a deploy on its exit code. And it is deliberately narrow: it answers one question about one endpoint rather than surveying an application, which is why its output is short enough to read in full every time.
Because the two are used at different moments. A full assessment happens occasionally, by a person, against a build of an application. A CORS misconfiguration is usually introduced by a one-line change to an allow-list months later, and the cheapest place to catch that is a check that runs on every deploy of your own staging environment and costs nothing to run again. That is what this tool is shaped for: six requests, a deterministic classification, an exit code. It does not replace an assessment, and a clean report from it is evidence about six specific requests, not a determination that the API is secure.
No. This site is not affiliated with, endorsed by, or sponsored by PortSwigger, and Burp Suite is a trademark of its owner, named here only to describe what this checker is and is not. The description of Burp Suite on this page is drawn from PortSwigger's own public site; check it there for what any edition currently includes.
Only point either tool at a system you own or are authorised to test. That rule is unchanged by which one you pick.