DevStack
Back

Security

CORS Tester

Enter a public API URL and the origin of the page that calls it. One response and one OPTIONS preflight report Access-Control-Allow-Origin, credentials, methods, headers, exposed headers, and Vary. Private API addresses are refused. Other origins are not tried, and the result is not stored.

CORS

Allow-Origin

See whether the response allows the frontend origin, a wildcard, or a different site.

Preflight

Check Allow-Methods and Allow-Headers for POST, PUT, PATCH, and DELETE.

Credentials and cache

Flag a wildcard paired with credentials, and a specific origin that forgets Vary.

Input

Enter a public API URL and the frontend origin that calls it.

Enter the API URL and the frontend origin. One response and one OPTIONS preflight show whether that page would be allowed to read the result. Private API addresses are refused, and the result is not stored.