2026-11-14 · Daily security tips

Does your API echo back any Origin in its CORS headers?

Browsers block Access-Control-Allow-Origin: * when cookies are sent. So when a CORS error shows up, a common AI-suggested fix is to copy whatever Origin the request sends into that header and add Access-Control-Allow-Credentials: true. The error goes away, but now any site a signed-in user visits can call your API as them and read the reply.

Check: run curl -sI -H "Origin: https://evil.example" https://yourapp.com/api/your-route. If the reply has Access-Control-Allow-Origin: https://evil.example and Allow-Credentials: true, it is open.

Fix: keep an allowlist of your exact domains and only return those. Use * only for truly public data that needs no login, and never together with credentials.