API Testing · Middle · Question 49 of 75

How do you test CORS configuration of an API?

1Open the API in a browser tab and check that JSON appears
2CORS only matters for images, so APIs don't need it
3Send different Origin headers and check the allow headers

Show the answer

Correct answer: Send different Origin headers and check the allow headers

Explanation

Allowed origins should get Access-Control-Allow-Origin; others shouldn't. * together with credentials is a misconfiguration.

Further reading

MDN: CORS ↗

Test yourself

Take the API Testing · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.