More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Repair CORS Origin Validation Bugs

    1

    Repair CORS and Origin validation bugs that reflect untrusted origins, misuse suffix matching, combine credentials with unsafe wildcards, or apply inconsistent preflight rules.

    $1

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Repair CORS Origin Validation Bugs

    Repair CORS Origin Validation Bugs

    Example session with this skill installed

    Our API reflects Origin when it ends with .example.com, so evil-example.com can pass. Credentialed requests are enabled and OPTIONS uses a different allowlist helper. Repair the repository with deterministic request fixtures and keep the existing approved-origin policy.

    • Read your context and instructions
    • Compiled the repair cors origin

    Origin validation is string-suffix based and preflight/simple requests use different policy helpers. The repair normalizes origins once, applies exact DNS-label-aware allowlist rules, shares one decision function across OPTIONS and actual responses, and keeps credential/public-error policy unchanged.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    The problem

    Inconsistent CORS and Origin validation across different application layers often leads to security vulnerabilities or broken client requests. Discrepancies between proxy headers, application parsers, and validation logic create unpredictable trust boundaries and leaky state.

    What it does

    • Identifies and maps trust boundaries across origin parsing, allowlists, and preflight handling.
    • Normalizes origin matching for exact, wildcard, and null origin scenarios.
    • Synchronizes CORS state ownership between proxies and application backends.
    • Implements deterministic local fixtures and focused regression tests for CORS policies.
    • Aligns Vary headers and metadata to ensure correct caching and credentialed access.

    Why this beats prompting it yourself

    General prompts often suggest insecure workarounds like broad wildcards or disabling validation to "fix" errors. This skill enforces strict adherence to existing authorization and credential policies while fixing the underlying architectural mismatch between components.

    Use cases

    • Fixing mismatched origin validation between an Nginx proxy and a Node.js API.
    • Repairing broken preflight cache policies in microservices.
    • Correcting Vary header metadata to prevent cross-origin credential leaks.
    • Implementing deterministic test suites for complex wildcard origin matching.

    Known limitations

    Requires local repository access via filesystem tools. Cannot interact with production environments, live secrets, or real customer data.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for APIs & Backend.

    Cannot redesign authorization policy, approved origin policy, credential policy, preflight cache policy, response semantics, and public errors; cannot verify production infrastructure or prove every runtime, proxy, network, filesystem, or scheduler ordering.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 2 months ago

    Permissions

    Terminal / Shell
    Read Files
    Write Files

    Run on a clean branch with repository files and disposable local fixtures. Review patches and validation before merge. Keep production services, real credentials, customer payloads, and deployment out of scope.

    Listed2 months ago
    Updated9 days ago

    What's inside

    Frequently Asked Questions

    This skill detects and repairs architectural mismatches in CORS policies, such as unsafe reflection of untrusted origins, suffix-matching vulnerabilities, and inconsistent preflight handling between proxies and backends.

    The skill is designed for use with any AI agent that supports filesystem tool access, such as Claude Dev, Roo Code, or GitHub Copilot Extensions, allowing it to analyze and modify your local repository.

    You will receive the proprietary skill configuration, specialized logic for origin validation mapping, and a suite of deterministic test fixtures to verify the repairs across your codebase.

    It works across common web stacks, including Nginx/Apache proxies and various backend frameworks like Node.js, Python, and Go, by synchronizing header logic between these layers.

    Simply import the skill into your AI agent's configuration and point it toward your project's configuration files; it will then map your trust boundaries and suggest precise code modifications.

    No, the skill operates strictly within your local development environment using filesystem tools to ensure your production data and live secrets remain secure and untouched.

    New in APIs & Backend