Never allow the null origin in CORS on Apache

Why it matters

Any website can send requests with Origin null from a sandboxed frame, so allowing null with credentials lets every site read responses with your visitors' cookies. Remove null from the allowed origins.

The fix

1. Remove null from the SetEnvIf or RewriteCond pattern that allows origins, or switch to an exact allow-list of https origins, and reload.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Replace CORS origin reflection with an allow-list
• Drop credentials or the wildcard from CORS
• Limit CORS to the origins that need it