HTTP Security Headers

Access-Control-Allow-Origin (CORS)

The core CORS header that decides which other origins are allowed to read your API responses from the browser — get the wildcard-plus-credentials combo wrong and you leak data.

What it is

The same-origin policy blocks JavaScript on one origin from reading responses from another. Cross-Origin Resource Sharing (CORS) is the controlled relaxation of that rule, and Access-Control-Allow-Origin (ACAO) is its central header: it names the origin(s) allowed to read the response. It is set by the responding server, not the caller.

Values & related headers

*
Any origin may read the response — but only for requests that do NOT include credentials.
https://app.example.com
Grants access to exactly one origin. Echo the request's Origin (from an allow-list) to support several.
Access-Control-Allow-Credentials: true
Allows cookies/authorization on the cross-origin request. Cannot be combined with a wildcard origin.
Access-Control-Allow-Methods
Methods permitted on the actual request (preflight response).
Access-Control-Allow-Headers
Request headers permitted on the actual request (preflight response).
Vary: Origin
Required when you echo the Origin, so caches don't serve one origin's ACAO to another.
HTTP RESPONSE HEADERS
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Vary: Origin

Never reflect Origin blindly with credentials

Echoing the request Origin back into ACAO and sending Access-Control-Allow-Credentials: true without an allow-list means any site can make credentialed requests and read the response — a serious data-exfiltration hole.

Why it matters

  • It is the boundary that decides whether another website's JavaScript can read your (possibly authenticated) API responses.
  • A misconfigured ACAO — especially reflected origin plus credentials — turns your API into an open cross-origin data source for any attacker page.
  • Correct CORS is required for legitimate SPAs and third-party integrations to call your API from the browser.

Common mistakes

  • Reflecting the incoming Origin header unconditionally, effectively allowing every origin.
  • Combining Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true — browsers reject this, and trying to fix it by reflecting Origin creates the exfiltration hole above.
  • Omitting Vary: Origin when echoing origins, so a shared cache serves the wrong ACAO to a different origin.
  • Treating CORS as a server-side access control — it only governs browser read access; it does not authenticate or authorize the caller.

How WebInspect checks this

  • WebInspect reports the Access-Control-Allow-Origin value and whether credentials are allowed.
  • It flags the dangerous reflected-origin-with-credentials pattern and wildcard misuse.
  • It checks for Vary: Origin when the ACAO appears to be dynamically echoed.