security9 min readUpdated 2025-12-20
CORS: Cross-Origin Resource Sharing
CORS is the mechanism browsers use to decide whether one origin can read a response from another. It is a browser feature, not a server firewall — and misconfiguring it opens holes that are exploited constantly.
Access-Control-Allow-Origin: *
Safe only on truly public read-only endpoints. Never combine it with credentials — browsers reject that combination, and any workaround leaks data.
Reflecting the Origin
If you echo the Origin header back into Access-Control-Allow-Origin, allowlist against a known set. Reflecting anything is equivalent to *.
Frequently asked questions
Try it on your site
Run a free Website Auditor scan and see which of these controls you're missing.
Run a scan