Cross-Origin Intelligence
Simulate and audit Cross-Origin Resource Sharing (CORS) handshake logic. Test preflight (OPTIONS) requests and cross-domain access headers.
Access-Control-Allow-Origin: *
Content-Type: application/json
Understanding CORS
CORS (Cross-Origin Resource Sharing) is a system consisting of transmitting HTTP headers, that determines whether browsers block frontend JavaScript code from accessing responses for cross-origin requests.
The Preflight Logic: For "complex" requests (like those with PUT/DELETE or custom headers), the browser first sends an OPTIONS request. The server must respond with the appropriate `Access-Control-Allow-Methods` and `Access-Control-Allow-Headers` before the actual request can proceed.
Security Pitfall: Using `Access-Control-Allow-Origin: *` while also setting `Access-Control-Allow-Credentials: true` is strictly prohibited by browsers for security reasons. You must specify an explicit origin when allowing credentials.