Browser security boundaries
Configure CORS narrowly
Allow only the browser origins, methods, headers, and credential behavior an API actually needs.
8 minute lesson
CORS tells browsers which other origins may read a response. It is not authentication and it does not protect non-browser clients.
Return an exact allowed origin when credentials are involved, add Vary: Origin, and reject origins outside the allowlist. Avoid reflecting arbitrary input. If the frontend and API can share an origin, that simpler design removes a cross-origin policy.
An API reflects any Origin and allows credentials. A page on an attacker-controlled origin can read the signed-in user’s private API response.
A broad wildcard feels convenient during development, but it can escape into production unnoticed. Keep local origins explicit and separate from the production allowlist.
Send preflight and credentialed requests from the production origin, the local origin, and an unlisted origin. Save the response headers and prove the unlisted page cannot read the protected response.
Lesson completed