mscoutermarsh / cors-test

A tiny tool for checking if your CORS headers are setup correctly

Top 300 friends ⭐️

anmol098, injoon5, araguaci, Temtaime, AdamMomen, prakashsellathurai, WillAbides, brendanmurty, mscoutermarsh, dfreilich, vaimalaviya1233, jahirfiquitiva, lyquita, susanka068, tcbyrd, travisbyr, kallyas, rzhade3, sciencepal, mamun2425, katungi, mzaini30, jatin-rathee, OmgImAlexis, gargakshit, JamesMGreene, Schlauer-Hax, tirthajyoti-ghosh, amuuu, Ritika-Das, MuYunyun, agucova, na-ji, ephraimduncan, MarikIshtar007, gauravghongde, hiwijaya, anish-ansari, WaylonWalker, NoNamePro0, timburgan, notBdougie, gleich, whuang8, ildgz, vedic-partap, fly51fly, lucascosti, jasonlong, tarebyte, simonw, simonfl3tcher, jefftriplett, timothyr, anamul430470, hashtagchris, airzinger, tracydemery36, gokayokyay, doms, iMackson, tommylees112, krider2010, jimkang, vladimyr, marcelinollano, javierarce, hmarr, tmcw, baloran, ggamel, b8x, socheatsok78, bradpurchase, jclem, heimann, enriikke, jpemberthy, donokuda, BenEmdon, nixpad, eliperkins, maestromac, nholden, nickvanw, ryangjchandler, mxschmitt, m1guelpf, jessewaites, andreasklinger, nhuebecker, hfaulds, Ilshidur, cdb, mxie, iheanyi, andymckay, JasonEtco, cschleiden, wilhelmklopp, raulpenate, Movindu-tb, MGBrave, Carol42, schmeekygeek, munezerobagira, R3M4G, skullface, anis-marrouchi, RebeccaRamalho, mhauri, Fancy11111, adptheoctocat, bokssssss, liva32, nachoal, pranavraj1720, Skema1114, 0l1v3rr, jisungbin, YuZhangWang, danBamikiya, hackshen, immarktube, kinduff, L00N1E, ZTzTopia, aad211, Rahleks, MansiAyer, dayfundora, eavichay, shunkakinoki, carsonjones, ImLoaD, kokonut27, nushakkza, SirMendacium, kirillzhosul, bdougie, dacoffey, IronCodem, MarcinK50, lucaslamdev, ni5arga, jcblw, moghwan, cbebe, runxel, vishwaphansal7, 0xkhan, Anidimma, jayphills76, casswedson, dayne, ItalianSquirel, Valensce, silvncr, fahd-akbar, T4533N, darkdarcool, EpicGamer007, rayhanadev, tfSheol, Eandalf, adejorosam, Rohith04MVK, Dazt5, marcoroth, andrewmcodes, tomlin7, kjaksik, xPapla, CesarAugusto15, alexawesomecode, Mridul2820, DanRowe, sohansubhash, quackduck, myl989, cjdenio, BenNeighbour, adhaamehab, ojaha065, johnletey, 0xLeif, lukew3, arafat-hasan, CrazyChickenDev, NihalV123, bojdell, sebastien-vedrine, hedyhli, fcomovaz, dereknguyen269, AugustinJose1221, khanraisa124, ABSphreak, bsoyka, eagleanurag, munizmarcelle, MrRobotIsHere, utkarshpant, daniellalasa2, HsiangNianian, CamoCatX, Vinlock, cOborski, andreolf, TheDayIsMyEnemy, kamal-ganwani, ayakase, saraiovieira, vershwal, JuanCruzDalBello, akhilkarthik, marseko, MichaelDimmitt, scout0773, Tophhhhh, mike2339, ivan-developer-01, i183x, MuhammadIbtisam, sucessdy, rohitpaulk, sferik, jamiew, PineAppleGrits, NimaasW, mozz01, SophieHervieu, imMatheus, guilyx, yosiat, ppritesh, CODE-G-ROOT, David159dht, vinhmai0108, maciejpedzich, vermashaurya, ajtazer, EmilioBlacksmith, Limitinit, anoonan, shivamchhapola, X-itachi-X, julycrystal, kasinadhsarma, akashgupta7363, multikitty, BGRicker, emanoelcampos, ttiramisu, phnx47, eduardz097, abnas7511, HwangTaehyun, Shoaib19, bano-kauser, krapans, iamalbinnj, congthanhng, 8bllgrl, YassineBaghdadi, DamianoPellegrini, harmzway, AkshayHere, DavDeDev, fuzzygroup, Leoche, TheCleverIdiott, affix, ajayxdodiya, EyesackEl, floppydisk05, amdadulbari, TechPenguineer, Rohit19060, Sartaj21, generalpy101, HarshitKumar9030, GraceWXT, felipesanma, theglitchh, HENRYMARTIN5, Sam948-byte, Ochieng424, k2glyph, YogPanjarale, itsgoofer, bfrederick18, Jiaocz, DanyGlez94, Kay-Ceee, daalla, Yakumwamba, amiyoghoshstar, Mindula-Dilthushan, FPLCodes

Star this repo, to add yourself here.

How this works

This is autogenerated by a Ruby script that runs on Actions. See it here.

cors-test's Issues

False Negative: Does not include Origin Header in Request

I believe there may be an issue with this tester as it's done on the server side and not browser side. One of our vendors has been using this tool to verify if we have CORS issues on our assets.

In order for a server to respond with the access-control-allow-origin header it must be giving an origin header in the request, otherwise the server doesn't know this is a cross origin request and will omit the access-control-allow-origin from the response headers. Typically, this happens as a client side request, where the browser attaches the origin header to the request by looking at the address bar [1]. Since this implementation is all done server side the origin header is never added to the fetch request so the server will never add the access-control-allow-origin header in the response. According to the spec, "in any access control request, the Origin header is always sent." [2]. From another standpoint, to enable credentials and not default to sending the wildcard e.g. access-control-allow-origin: * back in the response, the server must read the origin header to do so. [3]
In contrast you can see this browser based tester does this correctly by observing the network requests in the debugging tools.

As an example you can look at this asset: https://assets.asktia.com/fonts/basis-grotesque-regular.woff2
This will fail (omit the access-control-allow-origin header) using this tool, but succeed (include the access-control-allow-origin header) using this browser based tester or a curl request e.g. curl -H "Origin: http://example.com" --verbose https://assets.asktia.com/fonts/basis-grotesque-regular.woff2

[1] https://stackoverflow.com/questions/15988323/cors-and-origin-header#:~:text=Yes.,an%20extra%20header%20is%20sent.
[2] https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#the_http_request_headers
https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSMissingAllowOrigin
[3] https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSMissingAllowOrigin