CORS & HTTP Security Headers Inspector

How to Inspect and Generate Security Headers

1. Paste raw HTTP response headers into the parser or manually select security header rules.
2. Specify directives for Content-Security-Policy (CSP), HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
3. Define Cross-Origin Resource Sharing (CORS) settings including Access-Control-Allow-Origin, allowed methods, headers, and credential handling.
4. Review the custom security grade (A+ to F) and risk recommendations generated by our heuristic evaluation model.
5. Export server configuration snippets for Nginx, Express.js (using the helmet and cors middleware packages), Apache, Caddy, or Next.js.

Key Features

• Heuristic Security Score & Risk Evaluator: Automated scoring model (A+ to F) informed by OWASP resources and modern browser security standards.
• CORS Misconfiguration Detector: Identifies critical vulnerabilities under the WHATWG Fetch Standard, such as combining wildcard origins (*) with Access-Control-Allow-Credentials: true.
• Raw Header Parser: Instantly parses response headers copied from cURL output, browser DevTools Network tab, or captured HTTP response headers.
• Server Export Generators: Produces production-ready configuration code for Nginx (add_header), Express.js (helmet/cors middleware), Apache (.htaccess), Caddy (Caddyfile), and Next.js (next.config.js).
• 100% Offline & Private: All header parsing and security evaluation occur locally in your browser memory without transmitting data to external servers.

Common Use Cases

• Web Application Hardening: Generate robust CSP, HSTS, and clickjacking protections (using CSP frame-ancestors or X-Frame-Options) to defend against Cross-Site Scripting (XSS), Clickjacking, and MIME-sniffing.
• API CORS Troubleshooting: Debug cross-origin request failures and safely configure origin allowlists for credentialed fetch requests.
• Security Compliance Audits: Verify response headers against security benchmarks and export documentation for devsecops reviews.
• Web Server Migration: Seamlessly translate security header directives between Nginx, Apache, Caddy, and Node.js frameworks.

Production Security Warnings

[!WARNING] HSTS Deployment Risk: Do not enable Strict-Transport-Security until valid HTTPS is fully configured and tested across the target domain and all relevant subdomains. Misconfiguring HSTS can render a domain inaccessible to users for the duration of the max-age value.

[!WARNING] CSP Directive Weakness: Including 'unsafe-inline' or 'unsafe-eval' in script-src directives significantly reduces the protection offered by Content-Security-Policy, exposing your application to XSS attacks. Prefer nonce-based or hash-based CSP architectures.

[!WARNING] Invalid CORS Credential Policy: Browsers enforcing the WHATWG Fetch Standard strictly reject cross-origin requests if Access-Control-Allow-Origin: * is combined with Access-Control-Allow-Credentials: true. Always specify an explicit origin when credentialed requests (cookies, TLS client certificates, or HTTP authentication) are required.

Frequently Asked Questions

What is Content-Security-Policy (CSP)?

Content-Security-Policy (CSP) is an HTTP response header that controls resource loading, script execution, and browser security behaviors (such as framing via frame-ancestors and form navigation via form-action). CSP serves as a primary defense-in-depth mechanism against Cross-Site Scripting (XSS) and data injection attacks.

Why is Access-Control-Allow-Origin: * invalid with credentials?

Under the WHATWG Fetch Standard, browser security models forbid wildcard origins when credentialed requests (credentials: 'include') involving HTTP cookies, TLS client certificates, or HTTP authentication credentials are sent. Allowing wildcards with credentials would permit any malicious origin to read authenticated responses on behalf of the user.

What is Strict-Transport-Security (HSTS)?

Strict-Transport-Security (HSTS, RFC 6797) forces compliant browsers to communicate with a domain exclusively over encrypted HTTPS connections. Directives include max-age (duration in seconds), includeSubDomains (enforcing HTTPS on all subdomains), and preload (signaling consent for inclusion in browser-maintained HSTS preload lists via hstspreload.org).

How does X-Frame-Options protect against Clickjacking?

X-Frame-Options is a legacy HTTP header that instructs browsers whether a page may be rendered inside <frame> or <iframe> elements (DENY or SAMEORIGIN), helping prevent Clickjacking attacks. Modern browser standards favor CSP's frame-ancestors directive for fine-grained frame embedding control, but X-Frame-Options is maintained for backward compatibility with older user agents.

What is X-Content-Type-Options?

Setting X-Content-Type-Options: nosniff forces browsers to adhere strictly to the MIME type declared in the Content-Type header, preventing browsers from "MIME-sniffing" response payloads into executable script or style contexts.

What is Referrer-Policy?

Referrer-Policy governs how much referrer information (the URL of the origin page) is sent in the Referer header when navigating or requesting subresources across origins. Recommended settings like strict-origin-when-cross-origin prevent sensitive path or query parameter leakage to external sites.

What is Permissions-Policy?

Permissions-Policy (formerly Feature-Policy) allows site operators to restrict or disable access to specific browser features and hardware APIs (such as camera, microphone, geolocation, and payment) for the document and embedded frames.

How is Express.js configured for security headers?

Express.js does not provide security headers natively. Security headers are implemented using the popular third-party helmet middleware package (npm install helmet), alongside the cors middleware package (npm install cors) for Cross-Origin Resource Sharing policy handling.