Home / Knowledge hub / CORS
Knowledge hub
CORS
The browser rule for which sites may read responses from your API.
What it means
CORS, cross-origin resource sharing, is the browser rule deciding which other websites may read responses from your API. By default a page on one domain cannot read data from another, and CORS is how you make deliberate exceptions.
It relaxes a protection rather than adding one. Every entry you add names a site you are trusting with whatever your API returns.
Why it matters
Set too loosely, it lets an attacker's page read your customers' data using their own logged in session. The victim only has to visit the wrong page while signed in to you. Your logs show an ordinary authenticated request, because that is what it was.
People also misread it as a dial you can turn up. The browser rule protects your users from other sites. It does nothing against software sending requests directly, so loosening it is a decision about who may read customer data.
It gets blamed for a lot it did not do. Most of the daily pain is a browser refusing a request your own front end made, which is a configuration mistake rather than an attack.
How it shows up
The dangerous combination reflects back whatever origin asked and allows credentials at the same time. That amounts to 'any website may read this, as the logged in user'. Wildcards across subdomains come next, because they extend your trust to anything ever hosted on one.
Preflight behaviour deserves a look as well. An API that answers every options request permissively can allow methods and headers you never meant to expose.
Name the origins you actually need, and check the response your API really sends rather than the configuration you believe is in place.
Questions people ask
CORS, answered
Why does my request fail in the browser but work in Postman?
Because CORS is a browser rule, and Postman is not a browser. Your server answered both requests the same way. Only the browser applied the rule and refused to hand the response to your code.
That also tells you what CORS is for. It protects your users from other websites, not your API from software.
Why does the browser send an OPTIONS request first, and can I stop it?
That is the preflight. The browser asks whether the real request is allowed before sending it, which happens once a request uses a custom header or an unusual method.
You can avoid it by keeping requests simple, but you cannot switch it off from the server. Answer it properly and let the browser cache the answer.
Is setting Access-Control-Allow-Origin to a wildcard actually dangerous?
On a public endpoint that returns nothing private, no. On anything returning customer data, yes, because you are telling every website it may read the response.
Browsers refuse to combine the wildcard with credentials, which saves a lot of people. Reflecting back whatever origin asked and allowing credentials reaches the same dangerous place without the warning.
Can I just turn CORS off?
There is nothing to turn off. The restrictive behaviour is the default, and CORS headers are how you loosen it for named sites.
If cross-origin calls keep failing, the fix is to name the origins you want, not to remove the rule.
Does CORS protect us from cross-site scripting?
No. They handle different things. CORS controls which sites may read a response. Cross-site scripting runs on your own page, under your own origin, so the rule never applies to it.
A loose CORS policy can make an existing scripting bug worse, which is probably where the confusion starts.
Related
Terms that sit next to this one
API
The part of your application other software talks to, not a person.
CSRF
An attacker's page makes a logged-in user's browser act on your site.
Session hijacking
Stealing the token that tells your application a browser is logged in.
Allowlist
A list of what you permit, with everything else refused by default.
Which sites can read your API?
We check what your API really answers rather than the configuration you believe is set, including credentialed cross-site reads. Every finding comes with the request. Get in touch.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.