Limit CORS to the origins that need it

Why it matters

The server echoes any Origin, so every website can read these responses from a visitor's browser, which matters as soon as a response holds anything not meant for everyone. A fixed allow-list, or no CORS headers at all when nothing needs them, keeps that in check.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: find where CORS is configured and which other sites really need to read these responses.
2. Stage 2: if none do, remove the CORS headers. Otherwise echo the Origin only when it exactly matches your list, and send Vary: Origin so caches keep responses for different origins apart.

Access-Control-Allow-Origin: https://app.example.com
Vary: Origin

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Replace CORS origin reflection with an allow-list
• Never allow the null origin in CORS
• Drop credentials or the wildcard from CORS