CORX vs AllOrigins
Last checked 2026-09-17
AllOrigins: Website · Documentation
AllOrigins is the simplest CORS proxy around: a free, open-source Node service with `/get` and `/raw`, no key and no account. CORX solves the next problem — holding an upstream credential server-side that the browser never sees.
See it live: run a real injection from the landing demo.
Test any URL's CORS in your browser
| Topic | CORX | AllOrigins |
|---|---|---|
| Auth model | Per-key (`X-Api-Key` or Bearer), keyless access for granted origins, or a hosted instance's shared public key. Keys are stored as hashes in your own D1. | None documented: no key, no account, no quota page. `/get` and `/raw` are open. |
| Upstream secrets | Header and query rules live in D1 — AES-256-GCM ciphertext when `INJECTION_KEK` is set — and are applied server-side, only on the hosts the key allows. The browser never receives the value. | Nothing to inject with: the proxy forwards the request as it receives it, so any credential would have to come from the caller. Neither the service nor the code has a secret store. |
| Self-hosting | MIT, one Cloudflare Worker with D1 and R2, deployed to your own account; the free plan covers small deployments. | Open source (MIT) Node/Express: `git clone && npm install && npm start`. No Cloudflare account needed, any Node host works. The repository's last push was 2023-02-26. |
| Caching | R2 GET cache, adjusted per request with `corx-ttl` / `corx-no-cache` and capped per key; keys that inject request headers never share it, and a key's resolved response header rules are part of the cache key. | Not documented: the README and the site cover `charset`, `raw` and `callback`, with no cache controls. |
| Request logging | Every request lands in your D1 — target, host, status, latency, caller origin, key, IP, country. The raw window is yours to set (30 days by default, `LOG_RETENTION_DAYS`) and logging can be switched off entirely (`LOG_REQUESTS=false`); the daily aggregate keeps the trend. | Not documented for the hosted instance. The repository depends on `@logdna/logger`, so a self-hosted copy can ship logs to LogDNA (Mezmo) when configured. |
| Limits | Your own per-key rate limits and daily quotas, or the shared public tier's. Self-hosted, the ceiling is your Cloudflare plan. | Not documented: no daily, monthly or per-minute quota is published. |
| Price | Free and MIT-licensed. You pay Cloudflare for what the Worker serves; there is no subscription and no seat count. | Free and MIT-licensed, with a PayPal donate button in the README for the maintainer. |
| Time to first request | Deploy a Worker to your own account (about ten minutes), or copy a hosted instance's public key and send GET/HEAD inside its daily quota. | One URL, no key, no account: `api.allorigins.win/raw?url=…` and you are done.They win this rowAccepted trade-off |
| Beyond proxying | Proxying only: fetch, cache, inject, log, response header rules (strip `X-Frame-Options` / CSP for hosts you control), text re-encoding (`corx-charset`) and a JSON envelope (`corx-wrap`), plus a public CORS tester. No image transforms, scraping or file conversion. | None documented beyond proxying, `charset` conversion and JSONP `callback`. |
| Availability | Self-hosted: as available as your own Cloudflare account. The public instance is best-effort, with no SLA and no support commitment. | Community-run with no published SLA, and the repository has not been pushed since 2023-02-26. When we checked on 2026-09-17 the hosted API answered 5xx from our network. |
Where AllOrigins wins
AllOrigins asks nothing of you: no account, no key, no deploy, one URL. For pulling public pages into a hobby project that is genuinely less friction than CORX's public tier, which starts with copying a key — and its MIT Node server runs anywhere Node runs, Cloudflare or not.
Sources
Every AllOrigins cell above comes from their own documentation, read on the date shown — follow the links and check them. The CORX column describes this repository (README.md and FEATURES.md) and the same day's code.
- https://github.com/gnuns/allorigins (Last checked 2026-09-17)
- Auth model: The README documents `url`, `charset` and `callback` and nothing about keys or accounts; neither does the site.
- Upstream secrets: `/get` and `/raw` forward the request as it arrives — there is no credential store in the hosted service or in the code.
- Self-hosting: MIT-licensed Node/Express: `git clone`, `npm install`, `npm start`. The repository's last push is 2023-02-26 (checked via the GitHub API).
- Price: MIT license, free to use and self-host; the README carries a PayPal donate button for the maintainer.
- Beyond proxying: Beyond proxying, the documented surface is `charset` conversion and a JSONP `callback`.
- https://allorigins.win/ (Last checked 2026-09-17)
- Caching: The site and the README describe `charset`, `raw` and `callback` only — no cache controls and no TTL are documented.
- Limits: No quota, rate limit or fair-use policy is documented for the hosted instance.
- Time to first request: One URL, no key, no account: `api.allorigins.win/raw?url=…` is the whole setup.
- https://github.com/gnuns/allorigins/blob/main/package.json (Last checked 2026-09-17)
- Request logging: The repository depends on `@logdna/logger`, so a self-hosted copy can ship logs to LogDNA (Mezmo). Nothing about the hosted instance's retention is published.
- https://github.com/gnuns/allorigins/commits/main (Last checked 2026-09-17)
- Availability: Community-run, no published SLA, last push 2023-02-26. On 2026-09-17 every request we made to `https://api.allorigins.win/raw?url=…` from our network answered 5xx (500/522).
- CORX's own column: README.md · FEATURES.md
Both are about a line of code away. Try the public key on the landing page first, and self-host when the traffic matters. Back to the landing page