# CORS Policy Checker - Audit Access-Control-\* headers (`scrappy_garden/cors-policy-checker`) Actor

Check CORS response headers (Access-Control-Allow-Origin, -Credentials, -Methods, -Headers, -Expose-Headers, -Max-Age, Vary: Origin) for one or more URLs. Optionally performs a preflight OPTIONS check. Useful for debugging browser/API integrations and spotting risky CORS misconfigurations.

- **URL**: https://apify.com/scrappy\_garden/cors-policy-checker.md
- **Developed by:** [Bikram Adhikari](https://apify.com/scrappy_garden) (community)
- **Categories:** Developer tools
- **Stats:** 3 total users, 0 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$4.99/month + usage

To use this Actor, you pay a monthly rental fee to the developer. The rent is subtracted from your prepaid usage every month after the free trial period.You also pay for the Apify platform usage, which gets cheaper the higher Apify subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#rental-actors

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## CORS Policy Checker (Access-Control-\* Audit)

Audit CORS (Cross-Origin Resource Sharing) response headers for one or more URLs.

This actor sends a request with an `Origin` header and evaluates:

- `Access-Control-Allow-Origin`
- `Access-Control-Allow-Credentials`
- `Access-Control-Allow-Methods` (preflight)
- `Access-Control-Allow-Headers` (preflight)
- `Access-Control-Expose-Headers`
- `Access-Control-Max-Age`
- `Vary: Origin`

Optionally, it also performs a **preflight** `OPTIONS` request to validate that the server correctly allows the requested method/headers.

### Input

- **Start URLs**: URLs to check
- **Origin**: Origin header value used for the main request
- **Test second origin**: If enabled, makes a second request with a different Origin to detect overly permissive/reflected policies
- **Perform preflight**: If enabled, performs an OPTIONS preflight request
- **Proxy configuration**: Optional Apify proxy

### Output

#### Dataset (per URL)

Each dataset item contains:

- final URL + status
- CORS score (0-100)
- warnings/errors with codes
- parsed CORS-related headers
- optional preflight info

#### Key-value store

- `SUMMARY`: aggregate counts + average score
- `REPORT`: `SUMMARY` plus top issue codes

### Notes / disclaimers

- CORS behavior depends on request method and headers; this actor checks a **simple request** plus optional preflight.
- A missing `Access-Control-Allow-Origin` is not necessarily a “security issue” — it often simply means the resource is not intended for browser cross-origin access.

### Quick start

Store page: https://apify.com/scrappy\_garden/cors-policy-checker

Paste this into **Input** and click **Run**:

```json
{
  "startUrls": [
    {
      "url": "https://example.com/"
    }
  ],
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

### Outputs (what you get)

- **Dataset**: Dataset items typically include fields like: `startUrl`, `finalUrl`, `statusCode`, `redirected`, `corsScore`, `warningCount`, `errorCount`, `issues`, `checkedAt`.
- **Key-value store**: `REPORT`, `SUMMARY`

### Tips (trust + predictable results)

- Start with 1–3 URLs to validate behavior, then scale up.
- If a target blocks requests, enable Proxy and/or slow down concurrency in Input.
- Use the `SUMMARY` / `REPORT` keys (when present) for automation pipelines and monitoring.

### Related actors

- broken-link-checker (https://apify.com/scrappy\_garden/broken-link-checker)
- canonical-url-checker (https://apify.com/scrappy\_garden/canonical-url-checker)
- meta-tag-analyzer (https://apify.com/scrappy\_garden/meta-tag-analyzer)
- security-headers-checker (https://apify.com/scrappy\_garden/security-headers-checker)

### Search keywords

cors policy checker, cors policy checker - audit access-control-\* headers, website audit, seo

# Actor input Schema

## `startUrls` (type: `array`):

URLs to check for CORS response headers.

## `maxUrls` (type: `integer`):

Maximum number of URLs to process.

## `timeoutSecs` (type: `integer`):

Maximum time per URL request.

## `useHeadRequest` (type: `boolean`):

If enabled, tries HEAD first and falls back to GET when needed.

## `followRedirects` (type: `boolean`):

If enabled, follows redirects to the final URL.

## `maxRedirects` (type: `integer`):

Maximum number of redirects to follow when followRedirects is enabled.

## `origin` (type: `string`):

Origin header value to send (simulates a browser origin).

## `testSecondOrigin` (type: `boolean`):

If enabled, sends a second request with a different Origin to detect reflection/permissive policies.

## `secondOrigin` (type: `string`):

Second Origin value used when testSecondOrigin is enabled.

## `performPreflight` (type: `boolean`):

If enabled, performs an OPTIONS preflight request.

## `preflightRequestMethod` (type: `string`):

Value for Access-Control-Request-Method when performPreflight is enabled.

## `preflightRequestHeaders` (type: `string`):

Comma-separated header names for Access-Control-Request-Headers (optional).

## `userAgent` (type: `string`):

Custom User-Agent string to send with requests.

## `maxConcurrency` (type: `integer`):

Maximum number of URLs processed in parallel.

## `proxyConfiguration` (type: `object`):

Proxy settings for accessing websites.

## Actor input object example

```json
{
  "startUrls": [
    {
      "url": "https://example.com"
    },
    {
      "url": "https://jsonplaceholder.typicode.com/posts/1"
    }
  ],
  "maxUrls": 50,
  "timeoutSecs": 30,
  "useHeadRequest": false,
  "followRedirects": true,
  "maxRedirects": 10,
  "origin": "https://example.com",
  "testSecondOrigin": true,
  "secondOrigin": "https://evil.example",
  "performPreflight": false,
  "preflightRequestMethod": "GET",
  "preflightRequestHeaders": "authorization,content-type",
  "userAgent": "ApifyActor CORS Policy Checker (+https://apify.com)",
  "maxConcurrency": 10,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "startUrls": [
        {
            "url": "https://example.com"
        },
        {
            "url": "https://jsonplaceholder.typicode.com/posts/1"
        }
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("scrappy_garden/cors-policy-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "startUrls": [
        { "url": "https://example.com" },
        { "url": "https://jsonplaceholder.typicode.com/posts/1" },
    ] }

# Run the Actor and wait for it to finish
run = client.actor("scrappy_garden/cors-policy-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "startUrls": [
    {
      "url": "https://example.com"
    },
    {
      "url": "https://jsonplaceholder.typicode.com/posts/1"
    }
  ]
}' |
apify call scrappy_garden/cors-policy-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=scrappy_garden/cors-policy-checker",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/N4zSZlCRwpD0Odqr5/builds/FBydkqYLetW4Y8SSS/openapi.json