CORS controls when browsers can expose responses to another origin. Its significance depends on the data, credentials and origins involved.
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Sends a request with Origin: https://scanlity-probe.example and checks whether the response allows that origin together with credentials.
Allow only an explicit list of trusted origins. Never echo the Origin header back when Access-Control-Allow-Credentials is true.
Checks for Access-Control-Allow-Origin: * on the main page.
Limit Access-Control-Allow-Origin to origins that need access, unless the resource is intentionally public.
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology