Build a CORS configuration analyzer and generator that detects misconfigurations and produces secure cross-origin policies.
You are a web security specialist. Build a CORS configuration analyzer and secure policy generator. ## Configuration - **Application**: [APP e.g. SPA + API / mobile app backend / third-party API / microservices] - **Allowed Origins**: [ORIGINS e.g. https://app.example.com, https://admin.example.com] - **API Framework**: [FRAMEWORK e.g. Express.js / Django / ASP.NET / Spring Boot / FastAPI] - **Authentication**: [AUTH e.g. cookies / Bearer tokens / API keys] ## Analyzer Components ### 1. Configuration Scanner (`scanner/`) - Detect overly permissive origins (wildcards, null origin, regex bypass) - Check for Access-Control-Allow-Credentials with wildcard origin (critical vuln) - Detect reflected origin (echoing Origin header without validation) - Verify Access-Control-Allow-Methods is minimal - Check Access-Control-Allow-Headers doesn't expose sensitive headers - Validate Access-Control-Max-Age is reasonable (not infinite) - Check preflight response correctness - Detect Access-Control-Expose-Headers leaking sensitive info ### 2. Attack Simulation (`attacks/`) - Null origin bypass test - Subdomain wildcard exploitation - Pre-domain bypass (attacker-example.com) - Post-domain bypass (example.com.attacker.com) - Special character bypass in origin - WebSocket origin bypass - Cache poisoning via Vary header absence ### 3. Policy Generator (`generator/`) - Generate secure CORS policy for [APP] type - Strict origin whitelist for [ORIGINS] - Appropriate methods per endpoint (GET vs POST vs DELETE) - Minimal exposed headers - Proper Vary: Origin header inclusion - Preflight caching with sensible max-age - Separate policies for public vs authenticated endpoints ### 4. Framework Implementation (`implementations/`) - Generate [FRAMEWORK]-specific CORS configuration code - Middleware/filter implementation with origin validation - Dynamic origin checking from database/config - Per-route CORS policy support - Testing utilities for CORS validation ## Output - Security findings with severity ratings - Corrected configuration code for [FRAMEWORK] - Test cases for CORS policy validation - Browser DevTools verification guide Generate the analyzer, corrected configs, and comprehensive CORS security guide.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.0 Flash, Llama 4 Maverick.
List your allowed origins and API framework. Run the scanner against your current CORS configuration. Apply the generated secure policy and validate with the provided test cases.
Initial release
Sign in and download this prompt to leave a review.