Browser-local CORS metadata analyzer

CORS Exchange Lens

Explain a supplied request, optional preflight response, and actual response without sending the request anywhere.

Static explanation, not a live CORS test

This page makes no request to the entered URL. It analyzes only metadata kept in this page. Raw URL, origin, and header names or values appear only in explicit local-screen details and are excluded from the report.

Results are conservative. Browser version, redirect chains, caches, proxies, service workers, and server behavior can require review; this tool does not prove success, safety, or full browser-engine parity.

Input 1 · request

Request metadata

Names alone cannot establish value-sensitive safelist rules. Unknown values produce review rather than an assumed simple request.

Input 2 · actual response

Actual response metadata

For singleton response fields, put repeated field occurrences on separate lines so incompatible duplicates remain detectable.

Input 3 · optional and separate

Preflight response metadata

These values are never substituted for the actual response. If a preflight is required but this group is absent, the outcome stays unknown/review.

Bounded policy subset

The core compares normalized HTTP(S) origins and effective default ports; classifies GET/HEAD/POST, request-header names, bounded Content-Type values, and credentials modes; and checks supplied CORS response fields. It handles exact and wildcard origin rules, credential conflicts, method/header lists, malformed or duplicate singleton values, Vary, null origin, redirects, and expose-header constraints.

It does not send requests, inspect actual browser state, process cookies or tokens, model every Fetch rule, replay redirects, import HAR, proxy traffic, alter a server, or bypass security.

Optional manual review

CORS exchange review — USD 19

Up to 5 exchanges, one aggregate report, one remediation checklist, and one revision.

Email winni80@gmail.com. In the first email, do not send a URL, origin, cookies, authorization, token, personal data, or raw header values. Send only the value-free report plus browser and server type.

This is an inquiry route only. There is no payment link, and the offer is not evidence of inquiry, demand, payment, or revenue.