# CORX

> CORX is an open-source CORS proxy that runs entirely on Cloudflare's edge. Prefix any URL with
> /fetch?url= and fetch it cross-origin — with R2 edge caching, per-key auth, upstream secret
> injection, keyless browser access and SSRF guards.

CORX is a single Cloudflare Worker (Hono + HonoX) backed by D1 (keys, rate windows, request logs,
host blocklist) and R2 (GET response cache). It is MIT-licensed, self-hostable in one account, and
has no accounts, seats or bills of its own. This file is served by the instance at https://corx.envx.cn;
every URL below is absolute and current for that instance.

## Docs

- [Usage guide](https://corx.envx.cn/docs): the human-readable manual for this instance — the
  four call shapes, the `corx-*` parameter table, the three auth tiers, caching, limits and the
  security summary. Also at /en/docs and /zh/docs.
- [Framework and platform snippets](https://corx.envx.cn/snippets): copy-paste `fetch`/axios/ky
  examples, the key-hygiene rules for browser code, and how to call this instance from Cloudflare
  Pages, Vercel and Netlify. Also at /en/snippets and /zh/snippets.
- [CORS tester](https://corx.envx.cn/tools/cors-tester): paste a URL and see why a cross-origin
  request fails (the verdict is inferred from browser probes), then run it through this instance
  and copy the call that works. Also at /en/tools/cors-tester and /zh/tools/cors-tester.
- [Landing page](https://corx.envx.cn/): the pitch, a live demo that proxies real URLs from the
  browser, the shared public key and its daily quotas, the feature list and the FAQ.
- [Terms of use](https://corx.envx.cn/terms): quotas, prohibited uses, logging and liability for
  this hosted instance. Read it before sending traffic.
- Comparisons: [CORX vs corsproxy.io](https://corx.envx.cn/compare/corsproxy-io), [CORX vs Corsfix](https://corx.envx.cn/compare/corsfix), [CORX vs AllOrigins](https://corx.envx.cn/compare/allorigins) — dated, sourced differences against the hosted CORS proxies CORX is
  compared with, including the rows the other service wins.
- [Usage and options](https://github.com/envx-cn/corx/raw/main/README.md): calling conventions, the `corx-*` query namespace,
  caching and the full deployment guide — Markdown in the repository.
- [Feature list](https://github.com/envx-cn/corx/raw/main/FEATURES.md): every implemented feature mapped to the code that
  implements it.
- [Security policy](https://github.com/envx-cn/corx/blob/main/SECURITY.md): the threat model (SSRF guards, injection at rest,
  cache isolation) and the limitations that are accepted rather than fixed.
- [Contributing](https://github.com/envx-cn/corx/blob/main/CONTRIBUTING.md): self-hosting setup, the checks a change must pass and
  the repo conventions.
- [Full reference](https://corx.envx.cn/llms-full.txt): this instance's behaviour in one document,
  for agents that would rather not crawl the site.
- [Source repository](https://github.com/envx-cn/corx): TypeScript, MIT, issues and pull requests welcome.

## Calling the proxy

Four equivalent call shapes on https://corx.envx.cn: query (`/fetch?url=`), path (`/proxy/<url>`), bare
path (`/<url>`) and subdomain mode. GET and HEAD are cacheable; every other method passes straight
through uncached.

- `GET https://corx.envx.cn/fetch?url=<url-encoded target>` — the documented, recommended shape.
- `GET https://corx.envx.cn/proxy/<target>` and `GET https://corx.envx.cn/<target>` — path style.
- Subdomain mode, when the deployment has a wildcard zone: `api-example-com.<zone>/path`.
- Options are namespaced `corx-*` (`corx-ttl`, `corx-no-cache`, `corx-callback`, `corx-key`,
  `corx-charset`, `corx-wrap`, `corx-scheme`, `corx-port`); unknown names are rejected with 400, never
  forwarded upstream.

## Facts

- License: MIT (https://spdx.org/licenses/MIT.html).
- Stack: Cloudflare Workers, Hono/HonoX, D1, R2. No Node-only APIs.
- Auth: API keys per caller, keyless access by granted `Origin`, or a shared public key with
  daily quotas. GET and HEAD only on the public tier.
- Safety: SSRF guard (private ranges, DNS rebinding, D1 blocklist), 30-day request logs, no
  credentials forwarded on the public tier.
- Trust: a CORS proxy is a man in the middle by design. CORX is MIT-licensed and meant to be
  self-hosted — a hosted instance is a free, shared, best-effort demo, not a place for secrets or
  private data.
- Contact: abuse@envx.cn for abuse, security or content reports.

## Optional

- [Sitemap](https://corx.envx.cn/sitemap.xml) — indexable pages and hreflang alternates.
- [robots.txt](https://corx.envx.cn/robots.txt) — what is deliberately closed to crawlers.