CORS Tester

提供一个 Python 命令行脚本，通过 test、preflight、audit、config 四个子命令检查目标地址的 CORS 响应头、验证预检请求、审计常见 CORS 安全配置问题，并生成 nginx、apache、express、flask、fastapi、rails 等框架的 CORS 配置片段。

johnnywang2001

热度 80.80

最近更新 2026-05-11 17:31:34

分类：安全依赖：代码执行 / 第三方 API应用场景：API 集成 / 调试排错 / 代码生成 / DevOps

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add cors-tester

Metadata

name: cors-tester
description: Test and debug CORS (Cross-Origin Resource Sharing) configurations on live URLs. Use when checking if a server returns correct CORS headers, debugging CORS errors, testing preflight OPTIONS requests, verifying allowed origins/methods/headers, or auditing CORS security posture. Also use when generating CORS configurations for Apache, Nginx, Express, or other frameworks.

cors-tester

Test, debug, and generate CORS configurations from the command line.

Quick Start

# Test CORS headers on a URL
python3 scripts/cors_tester.py test https://api.example.com/data --origin https://myapp.com

# Test preflight (OPTIONS) request
python3 scripts/cors_tester.py preflight https://api.example.com/data --origin https://myapp.com --method POST --header "Content-Type"

# Generate CORS config for a framework
python3 scripts/cors_tester.py config --framework nginx --origins "https://myapp.com,https://staging.myapp.com" --methods "GET,POST,PUT,DELETE"

# Audit CORS security
python3 scripts/cors_tester.py audit https://api.example.com/data

Commands

`test`

Send a request with an Origin header and inspect the CORS response headers.

python3 scripts/cors_tester.py test <url> --origin <origin> [--method GET]

Options:

--origin <url> — Origin to test (required)
--method <method> — HTTP method (default: GET)
--verbose — Show all response headers

Output shows:

Access-Control-Allow-Origin — Whether the origin is allowed
Access-Control-Allow-Credentials — Whether credentials are supported
Access-Control-Expose-Headers — Which headers are exposed

`preflight`

Send an OPTIONS preflight request to test if a cross-origin request would be allowed.

python3 scripts/cors_tester.py preflight <url> --origin <origin> [--method POST] [--header Content-Type]

Options:

--origin <url> — Origin to test (required)
--method <method> — Method to request (default: POST)
--header <name> — Custom header to request (repeatable)

Output shows:

Access-Control-Allow-Methods — Allowed methods
Access-Control-Allow-Headers — Allowed headers
Access-Control-Max-Age — Preflight cache duration

`audit`

Check a URL for common CORS misconfigurations and security issues.

python3 scripts/cors_tester.py audit <url>

Checks for:

Wildcard origin (*) with credentials
Origin reflection (server echoes any origin back)
Missing Vary: Origin header
Overly permissive allowed methods
Missing preflight cache (Access-Control-Max-Age)

`config`

Generate CORS configuration snippets for common frameworks.

python3 scripts/cors_tester.py config --framework <name> --origins <origins> [--methods <methods>] [--headers <headers>] [--credentials]

Options:

--framework <name> — Target: nginx, apache, express, flask, fastapi, rails
--origins <csv> — Comma-separated allowed origins
--methods <csv> — Comma-separated methods (default: GET,POST,OPTIONS)
--headers <csv> — Comma-separated allowed headers (default: Content-Type,Authorization)
--credentials — Allow credentials
--max-age <seconds> — Preflight cache (default: 86400)