Tester de CORS

Verifica headers CORS de cualquier endpoint

Policy Rating: A+

Origin: https://app.mycompany.com

Cross-Origin Resource Sharing (CORS) Parameters

Target API Endpoint URL:

Request Origin (or *):

Access-Control-Request-Method:

Access-Control-Request-Headers:

Access-Control-Allow-Credentials

Permits cookies and authorization headers in cross-origin requests

true

Security Diagnostics & Browser Behavior

Strict origin whitelisting provides optimal isolation against cross-site data leaks.

Preflight OPTIONS Mechanics

Browsers automatically send an HTTP OPTIONS preflight check when a request includes non-standard headers, credentials, or custom methods before executing the actual payload.

Preflight Validation cURL Command

curl -I -X OPTIONS "https://api.mycompany.com/v1/user" \
  -H "Origin: https://app.mycompany.com" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: Content-Type, Authorization, X-Requested-With"

Node.js Express CORS Middleware Configuration

import cors from 'cors';

const corsOptions = {
  origin: ['https://app.mycompany.com'],
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Authorization'],
  credentials: true,
  maxAge: 86400 // 24 hours preflight cache
};

app.use(cors(corsOptions));

Next.js 16 Route Handler OPTIONS Preflight Method

// In Next.js route handler or proxy
export async function OPTIONS() {
  return new Response(null, {
    status: 204,
    headers: {
      'Access-Control-Allow-Origin': 'https://app.mycompany.com',
      'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
      'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With',
      'Access-Control-Allow-Credentials': 'true',
      'Access-Control-Max-Age': '86400',
    },
  });
}