CORS testing in Postman

Introduction

CORS testing checks if a website allows safe sharing of resources between different sites. It helps keep your data safe from unwanted access.

When your web app calls an API hosted on a different domain.

When you want to make sure your server allows only trusted websites to access its data.

When debugging errors related to blocked requests in the browser console.

When adding new third-party services that interact with your website.

When testing security rules for cross-site requests.

Syntax

Postman

1. Open Postman.
2. Create a new request.
3. Set the request method (GET, POST, etc.) and URL.
4. Add headers like 'Origin' to simulate cross-origin requests.
5. Send the request.
6. Check the response headers for 'Access-Control-Allow-Origin' and related CORS headers.

The 'Origin' header is important to simulate requests from different websites.

Look for 'Access-Control-Allow-Origin' in the response to see if CORS is enabled.

Examples

This simulates a GET request from 'https://mywebsite.com' to check if the API allows it.

Postman

GET https://api.example.com/data
Headers:
  Origin: https://mywebsite.com

This tests if POST requests from 'https://trustedsite.com' are accepted by the server.

Postman

POST https://api.example.com/submit
Headers:
  Origin: https://trustedsite.com
Body:
  {"name": "Alice"}

Sample Program

This test checks if the API allows requests from 'https://mywebsite.com'. The presence of 'Access-Control-Allow-Origin' with the same origin means CORS is enabled correctly.

Postman

GET https://api.example.com/data
Headers:
  Origin: https://mywebsite.com

// After sending the request in Postman, check response headers:
// Access-Control-Allow-Origin: https://mywebsite.com
// Access-Control-Allow-Methods: GET, POST
// Access-Control-Allow-Headers: Content-Type

Important Notes

Always test with the exact 'Origin' header your web app will use.

Missing or incorrect CORS headers cause browsers to block requests, even if the server responds.

Postman does not enforce CORS, so checking headers is key to verify server behavior.

Summary

CORS testing ensures safe sharing of resources across websites.

Use Postman to simulate cross-origin requests by setting the 'Origin' header.

Check response headers to confirm if CORS is properly configured.