CORS check for a public HTTPS endpoint

CORS check for a public HTTPS endpoint: three GET requests with a made-up origin, the null origin and no origin, reporting whether the server echoes the origin, allows null, returns a wildcard, and allows credentials. Only reads response headers of GET requests; it does not test preflight, methods or authentication.

Paid test badge: not yet. The checks above are free: we call the tool without paying and read the payment request it sends back. The Verified badge needs paid calls whose answers match the promised output, and nobody can buy a badge.

Endpoint

GET https://api.fadeandco.workers.dev/api/agent-intel/cors-security-misconfig-audit

Our checks, last 30 days

Example input (from the provider)

{
  "method": "GET",
  "queryParams": {
    "url": "https://httpbin.org/get"
  },
  "type": "http"
}

Promised output schema (from the provider)

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "input": {
      "additionalProperties": false,
      "properties": {
        "method": {
          "enum": [
            "GET"
          ],
          "type": "string"
        },
        "queryParams": {
          "properties": {
            "url": {
              "description": "Public https:// endpoint address",
              "type": "string"
            }
          },
          "required": [
            "url"
          ],
          "type": "object"
        },
        "type": {
          "const": "http",
          "type": "string"
        }
      },
      "required": [
        "type",
        "method"
      ],
      "type": "object"
    },
    "output": {
      "properties": {
        "example": {
          "type": "object"
        },
        "type": {
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "type": "object"
    }
  },
  "required": [
    "input"
  ],
  "type": "object"
}

This page as JSON