CORS Policy Calculator

Configuration risk = mean(origin policy, credentials, methods, headers, exposed headers) on the OWASP 0–9 scale, plus 2 when an opaque origin is accepted; impact = data sensitivity. The dangerous combination is a reflected or loosely matched origin together with Allow-Credentials: true, because that lets any page the victim visits read authenticated responses from your API. A wildcard origin scores lower than reflection since browsers refuse to combine * with credentials at all.

A permissive CORS policy is a same-origin bypass you deployed yourself — it turns every authenticated GET endpoint into a cross-origin data feed with no exploit required.

This calculator takes 8 inputs: Access-Control-Allow-Origin, Access-Control-Allow-Credentials, Allowed methods, Allowed request headers, Exposed response headers, Opaque origin (sandboxed iframe / local file) is accepted, Sensitivity of the data behind the API, Access-Control-Max-Age. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because reflection works with credentials and a wildcard does not. Browsers reject Access-Control-Allow-Origin: * whenever Allow-Credentials is true, so a wildcard leaks only unauthenticated data. Reflecting whatever Origin arrives satisfies the browser check for every attacker origin at once.