Stop reflecting the CORS request origin

cors-origin-reflect

Your server echoes back whatever Origin asks, which turns the CORS allowlist into a rubber stamp. Compare the origin against a fixed list.

Your stack

Cloudflare

1 Use Transform Rules to set a static Access-Control-Allow-Origin
2 Or handle CORS logic in a Cloudflare Worker

javascript

// Cloudflare Worker example
const ALLOWED = new Set(["https://app.example.com"]);
addEventListener("fetch", event => {
  const origin = event.request.headers.get("Origin");
  if (ALLOWED.has(origin)) {
    response.headers.set("Access-Control-Allow-Origin", origin);
  }
});

Nginx

1 Replace origin reflection with an explicit allowlist
2 Never blindly mirror the Origin header back

nginx

# Replace this pattern:
#   add_header Access-Control-Allow-Origin $http_origin;
# With an explicit allowlist:
map $http_origin $cors_origin {
    default "";
    "https://app.example.com" $http_origin;
    "https://www.example.com" $http_origin;
}
add_header Access-Control-Allow-Origin $cors_origin always;

Next.js

1 Handle CORS in middleware or API routes
2 Validate the Origin against an allowlist

typescript

// middleware.ts or API route
const ALLOWED_ORIGINS = new Set([
  "https://app.example.com",
  "https://www.example.com",
]);

export function middleware(request) {
  const origin = request.headers.get("origin");
  const headers = new Headers();
  if (origin && ALLOWED_ORIGINS.has(origin)) {
    headers.set("Access-Control-Allow-Origin", origin);
    headers.set("Access-Control-Allow-Credentials", "true");
  }
  // ...
}

Express

1 Use the cors middleware with an explicit origin list
2 Never use origin: true in production

javascript

const cors = require("cors");
app.use(cors({
  origin: ["https://app.example.com", "https://www.example.com"],
  credentials: true,
}));

Express docs

Django

1 Install django-cors-headers
2 Set an explicit allowlist, never use CORS_ALLOW_ALL_ORIGINS

python

# pip install django-cors-headers
# settings.py
CORS_ALLOWED_ORIGINS = [
    "https://app.example.com",
    "https://www.example.com",
]
CORS_ALLOW_CREDENTIALS = True
# NEVER: CORS_ALLOW_ALL_ORIGINS = True

Django docs

Laravel

1 Configure allowed origins in config/cors.php
2 Never use ['*'] for allowed_origins with credentials

php

// config/cors.php
return [
    'allowed_origins' => [
        'https://app.example.com',
        'https://www.example.com',
    ],
    'supports_credentials' => true,
];

Laravel docs

Rails

1 Use the rack-cors gem with an explicit origin list

ruby

# Gemfile: gem 'rack-cors'
# config/initializers/cors.rb
Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins 'https://app.example.com', 'https://www.example.com'
    resource '*', headers: :any, methods: [:get, :post], credentials: true
  end
end

Rails docs

Spring Boot

1 Configure CORS with explicit origins in your security config

java

@Bean
CorsConfigurationSource corsConfig() {
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowedOrigins(List.of(
        "https://app.example.com",
        "https://www.example.com"
    ));
    config.setAllowCredentials(true);
    config.setAllowedMethods(List.of("GET", "POST"));
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", config);
    return source;
}

ASP.NET

1 Configure CORS with explicit origins in Program.cs

csharp

builder.Services.AddCors(options =>
{
    options.AddDefaultPolicy(policy =>
    {
        policy.WithOrigins(
            "https://app.example.com",
            "https://www.example.com"
        ).AllowCredentials();
    });
});

Does your app still have this?

Scan your domain