CORS policy checker

\n Select APIs to probe. This checks Access-Control-* headers by sending an OPTIONS preflight and a HEAD/GET with an Origin header.\n (Some APIs block OPTIONS; that is still useful signal.)\n

\n\n \n\n \n `;\n\n return renderPage(body);\n}\n\nfunction renderResults(origin: string, rows: ResultRow[]): Response {\n const escapedOrigin = escapeHtml(origin);\n\n const tableRows = rows.map((r) => {\n const acaoG = escapeHtml(\n r.headOrGet.headers[\"access-control-allow-origin\"] ?? \"\",\n );\n const acamO = escapeHtml(\n r.options.headers[\"access-control-allow-methods\"] ?? \"\",\n );\n const acahO = escapeHtml(\n r.options.headers[\"access-control-allow-headers\"] ?? \"\",\n );\n const getStatus = r.headOrGet.error\n ? `ERR: ${escapeHtml(r.headOrGet.error)}`\n : `${r.headOrGet.status ?? \"\"} ${\n escapeHtml(r.headOrGet.statusText ?? \"\")\n }`.trim();\n const optStatus = r.options.error\n ? `ERR: ${escapeHtml(r.options.error)}`\n : `${r.options.status ?? \"\"} ${escapeHtml(r.options.statusText ?? \"\")}`\n .trim();\n\n const allHeadersJson = escapeHtml(\n JSON.stringify(\n { headOrGet: r.headOrGet.headers, options: r.options.headers },\n null,\n 2,\n ),\n );\n\n return `\n \n \n

${escapeHtml(r.name)}

${escapeHtml(r.url)}

\n ${r.notes ? `

${escapeHtml(r.notes)}

` : \"\"}\n \n ${escapeHtml(r.classification)}\n ${escapeHtml(r.browserSimpleGet)}\n ${escapeHtml(r.preflight)}\n \n

HEAD/GET: ${getStatus}

OPTIONS: ${optStatus}

GET ACAO: ${\n acaoG || \"(none)\"\n }

OPTIONS ACAM: ${\n acamO || \"(none)\"\n }

OPTIONS ACAH: ${\n acahO || \"(none)\"\n }

Headers

${allHeadersJson}

\n \n \n `;\n }).join(\"\");\n\n const jsonOut = escapeHtml(JSON.stringify(rows, null, 2));\n\n const body = `\n

CORS probe results

Origin used for probes: ${escapedOrigin}

\n \n

\n\n \n \n \n \n \n \n \n \n \n \n \n ${tableRows}\n \n

API	ACAO classification	Browser simple GET?	Preflight?	Details

\n\n

Copy results as JSON

${jsonOut}

\n `;\n\n return renderPage(body, \"CORS Probe Results\");\n}\n\nexport default async function handler(req: Request): Promise {\n const apis = uniqApis(APIS);\n const origin = new URL(req.url).origin;\n\n if (req.method === \"GET\") {\n return renderForm(apis);\n }\n\n if (req.method !== \"POST\") {\n return new Response(\"Method Not Allowed\", { status: 405 });\n }\n\n const form = await req.formData();\n const selectedIds = (form.getAll(\"api\") as string[]).map(String);\n const customUrlRaw = String(form.get(\"customUrl\") ?? \"\").trim();\n const customNameRaw = String(form.get(\"customName\") ?? \"\").trim();\n\n const selectedItems: ApiItem[] = [];\n const byId = new Map(apis.map((a) => [a.id, a]));\n\n for (const id of selectedIds) {\n const item = byId.get(id);\n if (item && item.testUrl) selectedItems.push(item);\n }\n\n if (customUrlRaw) {\n try {\n const u = new URL(customUrlRaw);\n selectedItems.push({\n id: \"custom\",\n name: customNameRaw || \"Custom URL\",\n testUrl: u.toString(),\n });\n } catch {\n selectedItems.push({\n id: \"custom_invalid\",\n name: customNameRaw || \"Custom URL (invalid)\",\n testUrl: \"invalid://\",\n notes: `Invalid URL: ${customUrlRaw}`,\n });\n }\n }\n\n if (selectedItems.length === 0) {\n return renderPage(`\n

No APIs selected

Select at least one API checkbox (or provide a Custom URL), then submit.

\n \n `);\n }\n\n const TIMEOUT_MS = 10_000;\n const CONCURRENCY = 8;\n\n const rows = await mapLimit(selectedItems, CONCURRENCY, async (item) => {\n const url = item.testUrl ?? \"\";\n if (!url || url.startsWith(\"invalid://\")) {\n const emptyProbe: Probe = { ok: false, error: \"no URL\", headers: {} };\n return {\n name: item.name,\n url: item.testUrl ?? \"\",\n classification: \"N/A\",\n browserSimpleGet: \"N/A\",\n preflight: \"N/A\",\n headOrGet: emptyProbe,\n options: emptyProbe,\n notes: item.notes ?? \"No usable URL\",\n } satisfies ResultRow;\n }\n\n const options = await probe(url, \"OPTIONS\", origin, TIMEOUT_MS);\n\n // Try HEAD first; fallback to GET because many APIs reject HEAD.\n let headOrGet = await probe(url, \"HEAD\", origin, TIMEOUT_MS);\n if (\n (headOrGet.status &&\n (headOrGet.status === 405 || headOrGet.status === 501)) ||\n headOrGet.error\n ) {\n headOrGet = await probe(url, \"GET\", origin, TIMEOUT_MS);\n }\n\n const c = classifyCors(headOrGet, options, origin);\n\n return {\n name: item.name,\n url,\n classification: c.classification,\n browserSimpleGet: c.browserSimpleGet,\n preflight: c.preflight,\n headOrGet,\n options,\n notes: item.notes,\n } satisfies ResultRow;\n });\n\n return renderResults(origin, rows);\n}","deleted","label",[114],"pulls",0,"forks","envVars",{"_137":131,"_139":131},"connections",{"_137":131,"_138":131},"count","unfilledCount","emptyCount",{"_20":113,"_13":114,"_115":116,"_117":-5,"_118":21,"_119":30,"_120":107,"_22":141,"_29":122,"_123":124,"_125":126,"_127":38,"_128":14,"_142":143,"_88":144},["D",1769545880880],"children",[],[114],["D",1769544644696],{"_11":12,"_86":82},{"_11":12,"_80":-5,"_81":82,"_45":46,"_83":84,"_85":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_75":-5,"_76":-5,"_77":-5,"_78":14,"_79":12},"ctx",{"_68":-5,"_109":182,"_183":184,"_185":186,"_187":38,"_188":38,"_189":38,"_190":107,"_191":-5,"_192":-7,"_193":-7,"_194":131,"_195":38,"_196":38,"_197":-5,"_198":38,"_199":38,"_200":38,"_201":-5},"ENV",{"_153":154,"_155":156,"_157":26,"_158":159,"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1