CORX vs Corsfix
Last checked 2026-09-17
Corsfix: Website · Documentation
Corsfix is the fair fight: like CORX it keeps upstream API keys out of the browser with server-side secret variables, and like CORX it is open source with a self-hosting path. What differs is where everything lives — their dashboard and servers, or your own Cloudflare account — and what each one defaults to.
See it live: run a real injection from the landing demo.
Test any URL's CORS in your browser
| Topic | CORX | Corsfix |
|---|---|---|
| Auth model | Per-key (`X-Api-Key` or Bearer), keyless access for granted origins, or a hosted instance's shared public key. Keys are stored as hashes in your own D1. | Dashboard domain whitelist — no key in the browser — with `x-corsfix-key` as a documented fallback; localhost needs no registration at all. |
| Upstream secrets | Header and query rules live in D1 — AES-256-GCM ciphertext when `INJECTION_KEK` is set — and are applied server-side, only on the hosts the key allows. The browser never receives the value. | `{{SECRET_NAME}}` variables in query parameters or request headers, encrypted at rest and decrypted in memory per request. Managed from their dashboard, not from your own database. |
| Self-hosting | MIT, one Cloudflare Worker with D1 and R2, deployed to your own account; the free plan covers small deployments. | Open source too (`github.com/corsfix/corsfix`): Docker Compose with MongoDB and Redis on your own VPS. |
| Caching | R2 GET cache, adjusted per request with `corx-ttl` / `corx-no-cache` and capped per key; keys that inject request headers never share it, and a key's resolved response header rules are part of the cache key. | `x-corsfix-cache` header with a duration (`10m`, `2h`, `1d`; invalid values default to one hour, capped at a day); GET only, and cached responses do not count against the plan's throughput. |
| Request logging | Every request lands in your D1 — target, host, status, latency, caller origin, key, IP, country. The raw window is yours to set (30 days by default, `LOG_RETENTION_DAYS`) and logging can be switched off entirely (`LOG_REQUESTS=false`); the daily aggregate keeps the trend. | Their privacy policy: no access logs at all — no URL, headers or body. Only aggregate performance metrics, error diagnostics purged after 30 days, and WAF logs (IP, user agent, path) for requests that breach a rule.They win this rowAccepted trade-off |
| Limits | Your own per-key rate limits and daily quotas, or the shared public tier's. Self-hosted, the ceiling is your Cloudflare plan. | Requests are unlimited on every plan, but throughput is per IP (60/120/180 RPM) and monthly outbound transfer is metered (25/100/500 GB). Free: localhost at 60 RPM, production trial 1 GB + 3 web apps. Lite: 600 RPM shared, text only, ≤1 MB. |
| Price | Free and MIT-licensed. You pay Cloudflare for what the Worker serves; there is no subscription and no seat count. | $5 Hobby, $9 Growth, $19 Scale per month; $29/year for the text-only Lite proxy; free for localhost and a production trial. VAT not included. |
| Time to first request | Deploy a Worker to your own account (about ten minutes), or copy a hosted instance's public key and send GET/HEAD inside its daily quota. | For local development: nothing at all — no registration, no key, one prefix. For production: add the domain in the dashboard and pick a plan for the traffic.They win this rowAccepted trade-off |
| Beyond proxying | Proxying only: fetch, cache, inject, log, response header rules (strip `X-Frame-Options` / CSP for hosts you control), text re-encoding (`corx-charset`) and a JSON envelope (`corx-wrap`), plus a public CORS tester. No image transforms, scraping or file conversion. | JSONP, header overrides and all file types; also region selection, a CORS tester and platform guides. |
| Availability | Self-hosted: as available as your own Cloudflare account. The public instance is best-effort, with no SLA and no support commitment. | Publishes a >99.9% availability figure from live data, with paid support and refunds behind it. CORX's hosted instance has no SLA — self-hosting is the answer it gives instead.They win this rowAccepted trade-off |
Where Corsfix wins
Corsfix wins where a managed product should: it logs no request URLs, headers or bodies at all (CORX logs to your own D1 by default — with a configurable window, including off), it publishes an availability figure with paid support behind it, and localhost needs no account whatsoever. Pick CORX when the secrets, the cache and the log rows should sit in your own account, and when paying Cloudflare suits you better than a subscription.
Sources
Every Corsfix cell above comes from their own documentation, read on the date shown — follow the links and check them. The CORX column describes this repository (README.md and FEATURES.md) and the same day's code.
- https://corsfix.com/docs/getting-started (Last checked 2026-09-17)
- Auth model: Production traffic is authorised by adding your website's domain in the dashboard; `x-corsfix-key` is documented as a fallback, and localhost needs no registration.
- https://corsfix.com/docs/cors-proxy/secrets-variable (Last checked 2026-09-17)
- Upstream secrets: `{{SECRET_NAME}}` variables can be used in query parameters and request headers; secrets are encrypted at rest and decrypted in memory only when a request uses them.
- https://corsfix.com/docs/open-source/self-hosting (Last checked 2026-09-17)
- Self-hosting: `git clone github.com/corsfix/corsfix`, Docker Compose with MongoDB and Redis, your own VPS — the docs cover logs, updates and domain configuration.
- https://corsfix.com/docs/cors-proxy/cached-response (Last checked 2026-09-17)
- Caching: The `x-corsfix-cache` request header takes `10s`/`10m`/`2h`/`1d` (invalid values default to one hour, capped at one day); GET only, and cached responses do not count against plan throughput.
- https://corsfix.com/privacy (Last checked 2026-09-17)
- Request logging: "We do not log or store access logs (no URL, headers, or body)" — only aggregate performance metrics; error diagnostics are purged after 30 days, and WAF logs (source IP, user agent, path) exist only for requests that breach a rule, purged in under 72 hours.
- https://corsfix.com/docs/cors-proxy/quotas (Last checked 2026-09-17)
- Limits: Throughput is 60/120/180 RPM per IP on Hobby/Growth/Scale with 25/100/500 GB monthly outbound transfer; the requests themselves are unlimited. Free tier: localhost at 60 RPM, production trial 1 GB + 3 web apps.
- https://corsfix.com/pricing (Last checked 2026-09-17)
- Price: $5 Hobby, $9 Growth and $19 Scale per month, or $29/year for the text-only Lite proxy at lite.corsfix.com; prices exclude VAT.
- https://corsfix.com/docs/free-tier (Last checked 2026-09-17)
- Time to first request: Local development takes no account, no key and one URL prefix; production takes adding the domain in the dashboard and a plan sized for the traffic.
- https://corsfix.com/docs (Last checked 2026-09-17)
- Beyond proxying: JSONP, request/response header overrides and every file type; also region selection, a CORS tester and platform integration guides.
- https://corsfix.com/ (Last checked 2026-09-17)
- Availability: The homepage claims ">99.9% availability, based on live data", backed by paid plans, support and 30-day refunds. CORX's hosted instance carries no SLA at all.
- CORX's own column: README.md · FEATURES.md
Both are about a line of code away. Try the public key on the landing page first, and self-host when the traffic matters. Back to the landing page