CORS Testing — How to Verify Cross-Origin Configuration with Curl, Postman, and Browsers

# Complete curl CORS test suite
# 1. Test simple GET request
echo "=== Test 1: Simple GET ==="
curl -s -I -H "Origin: https://app.example.com" \
  https://api.example.com/data | grep -i "access-control"

# 2. Test preflight
echo "=== Test 2: Preflight OPTIONS ==="
curl -s -X OPTIONS -I \
  -H "Origin: https://app.example.com" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: Content-Type" \
  https://api.example.com/data | grep -i "access-control"

# 3. Test blocked origin
echo "=== Test 3: Blocked Origin ==="
curl -s -I -H "Origin: https://evil.com" \
  https://api.example.com/data | grep -i "access-control"

# 4. Test with credentials
echo "=== Test 4: With Credentials ==="
curl -s -I -H "Origin: https://app.example.com" \
  -H "Cookie: session=abc" \
  https://api.example.com/profile | grep -i "access-control"

// Automated CORS test with Node.js
const http = require('http');

function testCors(origin, url, method = 'GET') {
  return new Promise((resolve, reject) => {
    const options = {
      headers: { 'Origin': origin },
      method: method === 'OPTIONS' ? 'OPTIONS' : method
    };

    const req = http.request(url, options, (res) => {
      const headers = res.headers;
      const result = {
        origin,
        url,
        method: options.method,
        'access-control-allow-origin': headers['access-control-allow-origin'],
        'access-control-allow-methods': headers['access-control-allow-methods'],
        'access-control-allow-credentials': headers['access-control-allow-credentials'],
        status: res.statusCode
      };
      resolve(result);
    });
    req.end();
  });
}

// Test multiple scenarios
async function runCorsTests() {
  const tests = [
    { origin: 'https://app.example.com', url: 'http://localhost:3000/api/data' },
    { origin: 'https://evil.com', url: 'http://localhost:3000/api/data' },
    { origin: 'https://app.example.com', url: 'http://localhost:3000/api/data', method: 'OPTIONS' }
  ];

  for (const test of tests) {
    const result = await testCors(test.origin, test.url, test.method);
    console.log(result);
  }
}

# Automated CORS tests with pytest
import requests

class TestCORS:
    BASE_URL = "https://api.example.com"
    ALLOWED_ORIGIN = "https://app.example.com"
    BLOCKED_ORIGIN = "https://evil.com"

    def test_allowed_origin_has_acao(self):
        response = requests.get(
            f"{self.BASE_URL}/data",
            headers={"Origin": self.ALLOWED_ORIGIN}
        )
        assert response.headers.get("Access-Control-Allow-Origin") == "*"

    def test_preflight_allows_post(self):
        response = requests.options(
            f"{self.BASE_URL}/data",
            headers={
                "Origin": self.ALLOWED_ORIGIN,
                "Access-Control-Request-Method": "POST"
            }
        )
        methods = response.headers.get("Access-Control-Allow-Methods", "")
        assert "POST" in methods

    def test_blocked_origin_should_have_no_acao(self):
        """For dynamic origin APIs, blocked origins should have no ACAO"""
        response = requests.get(
            f"{self.BASE_URL}/secure-data",
            headers={"Origin": self.BLOCKED_ORIGIN}
        )
        acao = response.headers.get("Access-Control-Allow-Origin")
        assert acao is None or acao != self.BLOCKED_ORIGIN