CORS checks with cors

Cors command builder

A CORS doctor: replays the exchange a browser would make — preflight, real request, and two differential probes — then tells you exactly what the browser will block and prints the config that fixes it.

Install this module

$ conflux install cors

v0.1.0

Examples

Common invocations to copy as-is, or use as a starting point for the builder below.

$ conflux cors https://api.example.com/orders --origin https://app.example.com

$ conflux cors https://api.example.com/orders --origin https://app.example.com \
$   -X POST -H "Content-Type: application/json" --credentials

$ conflux cors https://api.example.com/orders --origin https://app.example.com \
$   --fix-for nginx

$ conflux cors https://api.example.com/health --origin https://app.example.com \
$   --json --fail-on warning

$ conflux cors explain CORS-008

Command generator

Fill in the form and get a ready-to-run conflux cors command — only options that differ from the defaults are included.

Request

The endpoint, the origin the browser would send, and the request the page would make.

url

Endpoint to probe

--origin

Origin the browser would send — scheme, host and port, no trailing slash

--method, -X

--body

Request body; @path reads from a file

--header, -H

Headers the browser would send — each non-safelisted one triggers a preflight

Mode

Credentials mode and your Conflux session.

--credentials

Check in credentials mode (fetch credentials: 'include')

--auth

Attach your Conflux access token as Authorization: Bearer

Transport

Timeout, TLS and protocol options for the probes.

--timeout

Per-probe timeout

--insecure

Skip TLS certificate verification

--http1

Force HTTP/1.1

Output

Fix snippet, report formats and what makes the exit code non-zero.

--fix-for

Config snippet to print; auto detects the stack from the Server header

--fail-on

What makes the exit code 1

--json

Machine-readable output instead of the terminal report

--report

Also write a self-contained HTML report to this path

--plain

Plain uncoloured output

Generated command

$ conflux cors <url>

--origin is required — the origin the browser would send, with no trailing slash.