About this utility
How to use CSP & CORS Header Analyzer
Analyze Content-Security-Policy and CORS response headers for common security and interoperability problems.
What to provide
Paste a response header block containing CSP and/or Access-Control-* fields. Header names are case-insensitive.
- Paste, type, or drag and drop a supported text file into the input area.
- Choose the options that match your intended result.
- Select “Run tool” or press Ctrl/Command + Enter, then copy, download, or move the result back into the first input for another pass.
What the result means
Parsed directives, effective protections, CORS behavior, severity-ranked findings, and remediation guidance.
Privacy and safety
This utility is loaded as browser code and processes your input only in this tab. OmniCastConverter has no upload endpoint and never stores your content, filenames, tokens, or secrets. Generated markup and code are shown as inert text and are never executed.
Limitations
- This static analysis cannot observe redirects, browser preflights, report-only telemetry, dynamically assembled policies, or server routing behavior.
Try the included example
Select “Load example” at any time to restore this tested sample.
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST
X-Content-Type-Options: nosniff