CORS policy checker

\n Select APIs to probe. This checks Access-Control-* headers by sending an OPTIONS preflight and a HEAD/GET with an Origin header.\n (Some APIs block OPTIONS; that is still useful signal.)\n

\n\n \n\n \n `;\n\n return renderPage(body);\n}\n\nfunction renderResults(origin: string, rows: ResultRow[]): Response {\n const escapedOrigin = escapeHtml(origin);\n\n const tableRows = rows.map((r) => {\n const acaoG = escapeHtml(\n r.headOrGet.headers[\"access-control-allow-origin\"] ?? \"\",\n );\n const acamO = escapeHtml(\n r.options.headers[\"access-control-allow-methods\"] ?? \"\",\n );\n const acahO = escapeHtml(\n r.options.headers[\"access-control-allow-headers\"] ?? \"\",\n );\n const getStatus = r.headOrGet.error\n ? `ERR: ${escapeHtml(r.headOrGet.error)}`\n : `${r.headOrGet.status ?? \"\"} ${\n escapeHtml(r.headOrGet.statusText ?? \"\")\n }`.trim();\n const optStatus = r.options.error\n ? `ERR: ${escapeHtml(r.options.error)}`\n : `${r.options.status ?? \"\"} ${escapeHtml(r.options.statusText ?? \"\")}`\n .trim();\n\n const allHeadersJson = escapeHtml(\n JSON.stringify(\n { headOrGet: r.headOrGet.headers, options: r.options.headers },\n null,\n 2,\n ),\n );\n\n return `\n \n \n

${escapeHtml(r.name)}

${escapeHtml(r.url)}

\n ${r.notes ? `

${escapeHtml(r.notes)}

` : \"\"}\n \n ${escapeHtml(r.classification)}\n ${escapeHtml(r.browserSimpleGet)}\n ${escapeHtml(r.preflight)}\n \n

HEAD/GET: ${getStatus}

OPTIONS: ${optStatus}

GET ACAO: ${\n acaoG || \"(none)\"\n }

OPTIONS ACAM: ${\n acamO || \"(none)\"\n }

OPTIONS ACAH: ${\n acahO || \"(none)\"\n }

Headers

${allHeadersJson}

\n \n \n `;\n }).join(\"\");\n\n const jsonOut = escapeHtml(JSON.stringify(rows, null, 2));\n\n const body = `\n

CORS probe results

Origin used for probes: ${escapedOrigin}

\n \n

\n\n \n \n \n \n \n \n \n \n \n \n \n ${tableRows}\n \n

API	ACAO classification	Browser simple GET?	Preflight?	Details

\n\n

Copy results as JSON

${jsonOut}

\n `;\n\n return renderPage(body, \"CORS Probe Results\");\n}\n\nexport default async function handler(req: Request): Promise {\n const apis = uniqApis(APIS);\n const origin = new URL(req.url).origin;\n\n if (req.method === \"GET\") {\n return renderForm(apis);\n }\n\n if (req.method !== \"POST\") {\n return new Response(\"Method Not Allowed\", { status: 405 });\n }\n\n const form = await req.formData();\n const selectedIds = (form.getAll(\"api\") as string[]).map(String);\n const customUrlRaw = String(form.get(\"customUrl\") ?? \"\").trim();\n const customNameRaw = String(form.get(\"customName\") ?? \"\").trim();\n\n const selectedItems: ApiItem[] = [];\n const byId = new Map(apis.map((a) => [a.id, a]));\n\n for (const id of selectedIds) {\n const item = byId.get(id);\n if (item && item.testUrl) selectedItems.push(item);\n }\n\n if (customUrlRaw) {\n try {\n const u = new URL(customUrlRaw);\n selectedItems.push({\n id: \"custom\",\n name: customNameRaw || \"Custom URL\",\n testUrl: u.toString(),\n });\n } catch {\n selectedItems.push({\n id: \"custom_invalid\",\n name: customNameRaw || \"Custom URL (invalid)\",\n testUrl: \"invalid://\",\n notes: `Invalid URL: ${customUrlRaw}`,\n });\n }\n }\n\n if (selectedItems.length === 0) {\n return renderPage(`\n

No APIs selected

Select at least one API checkbox (or provide a Custom URL), then submit.

\n \n `);\n }\n\n const TIMEOUT_MS = 10_000;\n const CONCURRENCY = 8;\n\n const rows = await mapLimit(selectedItems, CONCURRENCY, async (item) => {\n const url = item.testUrl ?? \"\";\n if (!url || url.startsWith(\"invalid://\")) {\n const emptyProbe: Probe = { ok: false, error: \"no URL\", headers: {} };\n return {\n name: item.name,\n url: item.testUrl ?? \"\",\n classification: \"N/A\",\n browserSimpleGet: \"N/A\",\n preflight: \"N/A\",\n headOrGet: emptyProbe,\n options: emptyProbe,\n notes: item.notes ?? \"No usable URL\",\n } satisfies ResultRow;\n }\n\n const options = await probe(url, \"OPTIONS\", origin, TIMEOUT_MS);\n\n // Try HEAD first; fallback to GET because many APIs reject HEAD.\n let headOrGet = await probe(url, \"HEAD\", origin, TIMEOUT_MS);\n if (\n (headOrGet.status &&\n (headOrGet.status === 405 || headOrGet.status === 501)) ||\n headOrGet.error\n ) {\n headOrGet = await probe(url, \"GET\", origin, TIMEOUT_MS);\n }\n\n const c = classifyCors(headOrGet, options, origin);\n\n return {\n name: item.name,\n url,\n classification: c.classification,\n browserSimpleGet: c.browserSimpleGet,\n preflight: c.preflight,\n headOrGet,\n options,\n notes: item.notes,\n } satisfies ResultRow;\n });\n\n return renderResults(origin, rows);\n}","deleted","label",[100],"permalink","https://www.val.town/x/curtcox/cors-audit/code/main.ts","extension","actionData","errors"]