Fix a wildcard CORS origin with cookies

cors-wildcard-creds

A wildcard allow-origin combined with credentials is rejected by browsers, so the cross-origin calls you meant to allow just fail. Name the origin.

Why this matters

Your server sends Access-Control-Allow-Origin: * with credentials, but browsers block this combination per the CORS spec. The attack cannot succeed. Still a misconfiguration worth fixing.

Your stack

Web servers

Nginx

Frameworks

Express Django Laravel

Nginx

1 Never combine Access-Control-Allow-Origin: * with Allow-Credentials: true
2 Use a map to allowlist specific origins

nginx

# Remove:
#   add_header Access-Control-Allow-Origin * always;
#   add_header Access-Control-Allow-Credentials true always;
# Replace with origin allowlist (see cors-origin-reflect fix)

Express

1 Remove origin: '*' when using credentials: true
2 Use an explicit origin list instead

javascript

const cors = require("cors");
// BAD: origin: '*' with credentials: true
// GOOD:
app.use(cors({
  origin: ["https://app.example.com"],
  credentials: true,
}));

Django

1 Set CORS_ALLOW_ALL_ORIGINS = False and use CORS_ALLOWED_ORIGINS instead

python

# settings.py
CORS_ALLOW_ALL_ORIGINS = False  # was True
CORS_ALLOWED_ORIGINS = ["https://app.example.com"]
CORS_ALLOW_CREDENTIALS = True

Does your app still have this?

Scan your domain