{"slug":"api-webintel-api-workers-dev-api-security-cors-misconfig-dc0bb1","title":"Checks how a site's home page answers a cross-origin request from a made-up orig","host":"api.webintel-api.workers.dev","method":"GET","resource":"https://api.webintel-api.workers.dev/api/security/cors-misconfig","category":"other","description":"Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether credentials are allowed with it. Echoing an arbitrary origin together with credentials is the risky case. One GET of the home page; it does not te","price_listed":0.002,"price_asked":null,"state":"effects","state_label":"Not tested: has real-world effects","checks_7d":0,"answered_7d":0,"latency_ms_median":null,"reported_calls_30d":1,"reported_payers_30d":1,"networks":["eip155:10","eip155:137","eip155:143","eip155:42161","eip155:42220","eip155:480","eip155:5042","eip155:8453","solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","stellar:pubnet","xrpl:0"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"method":"GET","queryParams":{"domain":"httpbin.org"},"type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"method":{"enum":["GET"],"type":"string"},"queryParams":{"properties":{"domain":{"description":"Domain name such as httpbin.org (required)","type":"string"}},"required":["domain"],"type":"object"},"type":{"const":"http","type":"string"}},"required":["type","method"],"type":"object"},"output":{"properties":{"example":{"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"},"history":[],"description_full":"Checks how a site's home page answers a cross-origin request from a made-up origin: whether it echoes that origin back, sends a wildcard (*), and whether credentials are allowed with it. Echoing an arbitrary origin together with credentials is the risky case. One GET of the home page; it does not test API routes or the null origin.","last_updated":"2026-10-24T01:47:32.264Z","schemes":["exact"]}