Never allow the null origin in CORS on Cloudflare

Why it matters

Any website can send requests with Origin null from a sandboxed frame, so allowing null with credentials lets every site read responses with your visitors' cookies. Remove null from the allowed origins.

The fix

1. Stopgap at the edge: create a Response Header Transform Rule whose custom filter matches the hostnames and paths that no other site needs to read, with Remove operations for Access-Control-Allow-Origin and Access-Control-Allow-Credentials.
2. Remove null from the allowed origins where CORS is configured (application or web server).

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Replace CORS origin reflection with an allow-list
• Drop credentials or the wildcard from CORS
• Limit CORS to the origins that need it