Replace CORS origin reflection with an allow-list

Why it matters

The server copies any Origin into Access-Control-Allow-Origin and allows credentials, so any website a logged-in visitor opens can read your responses with their cookies. Only origins on a fixed list should ever get that permission.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find where CORS is configured: framework middleware set to allow any origin or to reflect the request's Origin, server config that copies the Origin header, or a plugin.
2. Stage 1: list the origins that really need to read your responses with cookies (your own front ends), and check which pages those clients call.
3. Stage 2: change the logic so an Origin that exactly matches the list is echoed with Access-Control-Allow-Credentials: true and Vary: Origin, and every other Origin gets no Access-Control headers. Never match by prefix, suffix or substring, which attacker domains can satisfy.
4. If nothing outside your own site needs credentialed access, remove Access-Control-Allow-Credentials altogether. Test your front ends afterwards.

# request from an allowed origin
Origin: https://app.example.com
# response
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Vary: Origin

# request from any other origin: no Access-Control-* headers in the response

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Never allow the null origin in CORS
• Drop credentials or the wildcard from CORS
• Limit CORS to the origins that need it