Limit CORS to the origins that need it on Apache

Why it matters

The server echoes any Origin, so every website can read these responses from a visitor's browser, which matters as soon as a response holds anything not meant for everyone. A fixed allow-list, or no CORS headers at all when nothing needs them, keeps that in check.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: replace rules that copy the Origin header with the allow-list below. Replace app\.your-domain\.com with your real origin, keeping the ^ and $ anchors and writing every dot as \. (an unescaped dot matches any character).
2. Stage 2: reload Apache and test the sites that call you.

SetEnvIf Origin "^(https://app\.your-domain\.com)$" CORS_ORIGIN=$1
Header onsuccess unset Access-Control-Allow-Origin
Header always unset Access-Control-Allow-Origin
Header always set Access-Control-Allow-Origin "%{CORS_ORIGIN}e" env=CORS_ORIGIN
Header always merge Vary Origin

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Replace CORS origin reflection with an allow-list
• Never allow the null origin in CORS
• Drop credentials or the wildcard from CORS