Checker
CORS checker
Paste the deployed URL. LeakWatch reads the homepage response headers. The CORS finding is one specific combination: Access-Control-Allow-Origin is a wildcard and Access-Control-Allow-Credentials is true.
The free report names every finding, with its severity and category. The most serious one is shown in full. The others keep the location, evidence, and fix prompt for the $19 Proof Report. One free scan per network every 30 days.
What this page is for
Wildcard plus credentials
Browsers reject that pair. A server that reflects the caller's Origin while credentials are on would let another site call the API with the visitor's cookies. The finding is medium.
A wildcard on its own
Access-Control-Allow-Origin: * without credentials is not listed as this finding. It still means any site can read the response if the browser allows that request.
What this does not do
LeakWatch does not send a credentialed cross-origin request, and it does not try to call your API from another origin.
Questions
- Will a missing CORS header fail the scan?
- No. No CORS header is a pass for this check. The finding is only the wildcard combined with credentials.
- Does the rest of the scan still run?
- Yes. This is the same free scan as the homepage.
A Proof Report is $19 once. Monitoring is $9/month. Pro is $29/month. No subscription is required for the report. See pricing.