Question 1

How does the CORS checker test a URL?

Accepted Answer

It sends seven GET requests with different Origin headers, an arbitrary origin, the null origin, a prefix and suffix variant of your own host, an unknown subdomain, and the plain HTTP origin, plus one OPTIONS preflight. It then compares the Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers in each response.

Question 2

Is a wildcard Access-Control-Allow-Origin dangerous?

Accepted Answer

A wildcard on public, unauthenticated content is fine. Browsers block credentials with a wildcard. The dangerous case is a reflected origin combined with Access-Control-Allow-Credentials: true, because any site can then read authenticated responses.

Question 3

Does the checker exploit anything?

Accepted Answer

No. It reads response headers only and does not use any credentials. Strix confirms exploitability with a real cross-origin proof of concept during a pentest.

Probe	Origin sent	Finds
Arbitrary origin	https://cors-probe.strix.ai	Origin reflection
null origin	null	Trust of sandboxed iframes
Host as prefix	https://<host>.cors-probe.strix.ai	startsWith or unanchored regex checks
Host as suffix	https://strixprobe<apex>	endsWith checks without a leading dot
Unknown subdomain	https://strix-cors-probe.<apex>	Wildcard subdomain trust
HTTP origin	http://<host>	Trust of the insecure scheme
Preflight	OPTIONS with PUT and custom headers	Approved methods and headers for untrusted origins

CORS Checker

How it works

Frequently asked questions

Start testing in minutes