API & Cross-Origin Auditing

CORS Misconfiguration & Policy Inspector

Audit API cross-origin security. Test for Origin reflection vulnerabilities, arbitrary origin trust, and dangerous credential-sharing configurations.

API Security

Test APIs for Origin reflection, wildcard credential leaks, and cross-origin data exposure vulnerabilities.

Target API Endpoint URL:

Tested Origin (Attacker Domain):

Request Type:

Detects if your API blindly reflects arbitrary incoming `Origin` request headers in `Access-Control-Allow-Origin`.

Flags critical vulnerabilities where cookies/JWT tokens (`credentials: true`) can be read by malicious third-party origins.

Sends simulated OPTIONS preflights to audit `Access-Control-Allow-Methods` and `Access-Control-Allow-Headers`.