Skip to main content
All rules

SEC-023

CORS trusts any website with credentials

HighDefault severity · Security · Secrets, HTTPS and security headers

Last reviewed

CORS that echoes any Origin while allowing credentials lets any website a signed-in user visits call your API with their cookies and read the answers. Replace the reflected origin with an explicit allowlist of your own domains, and only send Access-Control-Allow-Credentials for those.

In apps built with AI tools

When a front end on one domain cannot reach an API on another, the quickest fix an agent finds is to echo the request origin and allow credentials, which works and silently removes the browser’s protection.

What it checks

Requests the homepage and /api with Origin: https://lg-origin-check.invalid and checks whether the response echoes that origin while allowing credentials.

Why it matters

Any website a signed-in user visits can read their data from your API with their cookies, because the server trusts every origin.

Recommended fix

Only echo origins from an explicit allowlist, and never combine a reflected origin with Access-Control-Allow-Credentials: true.

How to verify

Send a request with Origin: https://lg-origin-check.invalid and confirm Access-Control-Allow-Origin is absent or not that value.

Example fix prompt

Generic prompt (your report adds the evidence)
Please fix this production issue in my app.

Issue SEC-023: CORS trusts any website with credentials
Site: https://your-app.example

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Replace the CORS configuration that reflects the request Origin with an explicit allowlist of the app’s own origins. Keep Access-Control-Allow-Credentials only for those origins.

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Send a request with Origin: https://lg-origin-check.invalid and confirm Access-Control-Allow-Origin is absent or not that value.

Questions

Is Access-Control-Allow-Origin: * also a problem?
Browsers refuse * together with credentials, so it is fine for public, cookie-free APIs, but not for anything that relies on cookies.

References