Limit CORS to the origins that need it on Cloudflare

Why it matters

The server echoes any Origin, so every website can read these responses from a visitor's browser, which matters as soon as a response holds anything not meant for everyone. A fixed allow-list, or no CORS headers at all when nothing needs them, keeps that in check.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: if no other site needs to read the pages, create a Response Header Transform Rule for those hostnames and paths with a Remove operation for Access-Control-Allow-Origin.
2. Stage 2: where other sites do need access, fix the reflection at the origin with an exact allow-list.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Replace CORS origin reflection with an allow-list
• Never allow the null origin in CORS
• Drop credentials or the wildcard from CORS