×
Ranked #1 for value density
First premium report free
LLM-optimized PDFs
How to Implement CORS Securely
Protect your API from unauthorized cross-origin requests.
Cross-Origin Resource Sharing (CORS) allows browsers to make requests to your API from different origins. Misconfigured CORS can expose your API to data theft or CSRF attacks. This guide explains CORS best practices and provides secure configuration examples.
150+
Security checks
16
Categories covered
30s
Scan duration
100%
Detection coverage
Key Findings
No CORS Policy Set medium
Reflecting Origin Header high
Credentials Allowed medium
What is CORS and Why is it Important?
CORS controls which domains can access your API. If you use `Access-Control-Allow-Origin: *`, any website can make requests to your API, potentially exposing sensitive data. If you reflect the `Origin` header without validation, attackers can exploit it. Proper CORS configuration is essential for API security.
Secure CORS Configuration – Best Practices
Follow these best practices for CORS:
- 1. Use a whitelist of allowed origins, never `*` in production
- 2. Never reflect the `Origin` header without validation
- 3. Set `Access-Control-Allow-Credentials` only when necessary (and use `true`)
- 4. Set `Access-Control-Allow-Methods` to the minimum needed (e.g., `GET, POST, PUT, DELETE`)
- 5. Set `Access-Control-Allow-Headers` to the minimum needed
- 6. Return a `403` or `405` for disallowed origins/methods
Code Examples
Here are examples of secure CORS configuration:
- Node.js (Express): `const cors = require("cors"); const allowedOrigins = ["https://trusted.com"]; app.use(cors({ origin: allowedOrigins, credentials: true, methods: ["GET", "POST", "PUT"], allowedHeaders: ["Content-Type", "Authorization"] }));`
- Python (Django): `CORS_ALLOWED_ORIGINS = ["https://trusted.com"]; CORS_ALLOW_CREDENTIALS = True;`
- PHP (Laravel): `return [ "paths" => ["api/*"], "allowed_origins" => ["https://trusted.com"], "allowed_methods" => ["GET", "POST"], "allowed_headers" => ["Content-Type", "Authorization"] ];`
- Nginx: `add_header Access-Control-Allow-Origin "https://trusted.com" always;`
The Problem
Misconfigured CORS can expose your API
- Using `*` for allowed origins
- Reflecting the `Origin` header without validation
- Allowing credentials with a wildcard
- No CORS policy at all (browsers block requests)
OffURL Solution
OffURL detects insecure CORS configurations and provides fix steps
- Check for `Access-Control-Allow-Origin` header
- Detect wildcard or reflected origins
- Verify `Access-Control-Allow-Credentials` settings
- Provide secure configuration examples
- Generate an LLM‑ready PDF for AI‑assisted fixes
Key Features
CORS detection
We scan for CORS headers and detect misconfigurations.
Fix examples
Get ready‑to‑use code for your framework.
LLM‑ready PDF
Get a report formatted for ingestion into your AI assistant.
Actionable fixes
Receive specific recommendations for your stack.
How do I check if my CORS is configured securely?
Run an OffURL audit. We check for CORS headers, detect wildcards or reflection, and verify credential settings. You'll get a detailed report with fix steps.
Frequently Asked Questions
What is OffURL and how does it work?
OffURL is a comprehensive website security and performance audit tool. It scans your site for 150+ checks including SSL, security headers, malware, XSS, SQL injection, email security, and more.
Is the security audit really free?
Yes. Your first security report is completely free and includes premium features like detailed findings, fix steps, and the full 150+ checks.
How can I use AI to fix security issues?
Download the premium PDF report and paste it into your preferred LLM (Claude, ChatGPT, Gemini, Cursor) with a prompt asking for specific fixes for your framework.
How long does the security audit take?
Most audits complete in 10‑30 seconds. The scan includes DNS lookups, SSL analysis, HTTP requests, port scanning, and vulnerability tests.
Do I need to create an account?
No. OffURL works without registration. Your first audit is free with premium features included.
What vulnerabilities can OffURL detect?
OffURL detects XSS, SQL Injection, NoSQL Injection, LDAP Injection, XXE, SSRF, SSTI, Code Injection, Command Injection, Open Redirect, Path Traversal, LFI, RFI, CRLF Injection, Parameter Pollution, and CORS Misconfiguration.