Permissive CORS Scanner
Checks whether your CORS policy reflects any origin with credentials, exposing your users' data.
What it checks
This scanner checks your CORS policy to see if it accepts requests from any origin while also allowing credentials to be sent. That combination is the most dangerous possible CORS setup. It only looks at how you respond to cross-domain requests, without accessing any data.
Why it matters
If you reflect any origin with credentials, a malicious site can make requests to your API using a logged-in user's session and read the response. That exposes your users' private data to third parties. It usually happens from copying an open configuration found in examples or tutorials.
How to fix it
Replace the wildcard origin with an explicit allowlist of trusted domains that actually need access to your API. If you do not need to send credentials across domains, turn that option off. Review your backend or framework CORS configuration and avoid automatically reflecting whatever origin arrives.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free