DNS & Glossary

CORS (Cross-Origin Resource Sharing)

The browser mechanism that lets a server opt in to requests from other origins, relaxing the same-origin policy through Access-Control response headers.

What it is

By default the same-origin policy blocks a page from reading responses from a different origin. CORS lets the server allow it by returning headers such as Access-Control-Allow-Origin. Non-simple requests trigger a preflight OPTIONS that checks the method and headers before the real request is sent.

HTTP RESPONSE HEADERS
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Credentials: true

Why it matters

  • It safely enables cross-origin APIs while preserving the same-origin protection for everything else.
  • Misconfiguration can either break legitimate apps or expose data to any site.

Common mistakes

  • Reflecting Access-Control-Allow-Origin: * together with Allow-Credentials: true, a dangerous and invalid combination.
  • Echoing the request Origin unconditionally, effectively allowing every site.

How WebInspect checks this

  • WebInspect and the API Inspector report CORS headers and flag overly permissive or unsafe configurations.