Assertwise Lab / Security headers
Security headersSecurity headers & CORS check with grade and fixes
We fetch your URL, probe CORS with a foreign Origin and a preflight, and grade the response headers and cookies.
RUNS ON OUR SERVER
Why CORS matters for APIs
If an API reflects any Origin and also sends Access-Control-Allow-Credentials: true, any website your users visit can read their authenticated API responses. This is one of the most common findings in our API audits.
Grading
Start at 100; missing HSTS or CSP cost 20 points, missing nosniff or clickjacking protection 10, weaker issues 2–8, a reflected origin with credentials 25. A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 45, otherwise F. The grade is a heuristic – context matters (a JSON API needs a different CSP than an app).
Want a senior engineer to look at the results?
Free tools give you a first signal. In a free 20-minute check-up we review your API, performance or test setup and tell you what to fix first.