What Is CORS, and How to Configure It?
CORS — Cross-Origin Resource Sharing — is the mechanism a server uses to tell browsers which other origins are allowed to read its responses. By default the same-origin policy forbids cross-origin reads; CORS is the controlled, opt-in way to permit specific exceptions. Misconfigure it and you hand your data to the whole internet.
How does CORS relax the same-origin policy?#
The server — the owner of the data — declares who may read it via response headers:
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Vary: OriginThe browser fetches the response but only exposes it to the page’s JavaScript if the requesting
origin matches the allowlist. For requests that can change state, the browser first sends a
preflight OPTIONS request to ask permission before the real one. CORS is thus a
conversation between server policy and browser enforcement.
What are the dangerous misconfigurations?#
CORS bugs are almost always about being too permissive:
| Misconfiguration | Why it is dangerous |
|---|---|
Allow-Origin: * on authenticated data | Any site can read users’ data |
Reflecting the Origin header blindly | Equivalent to allowing everyone |
Allow-Credentials: true + loose origin | Sessions readable cross-site |
Trusting null origin | Sandboxed iframes can exploit it |
CORS is not a defense you add — it is a restriction you carefully loosen. A CORS error usually means the same-origin policy is doing its job. More on APIs at REST API security and the Web Security hub.
Frequently asked questions#
What does CORS actually do?
CORS (Cross-Origin Resource Sharing) lets a server declare, via HTTP headers, which other origins are allowed to read its responses. By default the same-origin policy blocks cross-origin reads; CORS is the controlled way to permit specific exceptions. The browser enforces the server’s declared policy.
Why is a wildcard CORS policy dangerous?
Setting Access-Control-Allow-Origin to * on an authenticated endpoint, or reflecting the request Origin while allowing credentials, lets any website read that endpoint’s responses using the visitor’s session. That effectively hands your users’ data to any malicious page they visit. Wildcards belong only on truly public, non-credentialed resources.