Security finding
A response lets any website read it
Security Warning Severity: Medium
Part of the audit Security headers. Finding id: security.corsTooOpen.
What it costs you
The response tells browsers that any website may read it.
What to do
Allow only the origins that need the response.
What it checks
- Any site may read logged-in data
- Any site may read pages that set cookies
How to fix it
Allow only listed origins
- Find where the CORS headers are set for [host], usually the application, an API gateway or the web server.
- Keep a list of the origins that may read responses with cookies. When the request's Origin header is on the list, send that origin as Access-Control-Allow-Origin together with Vary Origin; otherwise send no Access-Control-Allow-Origin.
- Never send null or *, and never copy the Origin header back without checking it against the list.
How to check: curl -sI [example url] | grep -i '^access-control-allow'