CORS that trusts any origin (and sends cookies)

Steps

1. Find your CORS setup (framework middleware, next.config / vercel.json headers, or Supabase/Express config).
2. Look for code that copies the request's Origin header into Access-Control-Allow-Origin, allows the value null, or uses loose matching like endsWith or contains.
3. Replace it with an exact allowlist of your own origins (for example your production domain and your preview domain).
4. Only send Access-Control-Allow-Credentials: true for those exact origins; never with a wildcard or reflected origin.
5. On your own API, send a request with a made-up Origin header and confirm the response does not echo it back.

Why it matters

PortSwigger's Web Security Academy shows that when a server reflects the requesting origin and also allows credentials, a malicious site can make cookie-authenticated requests and read the responses. It also covers whitelisted null origins and broken origin matching.

Sources

PortSwigger Web Security Academy: CORS — https://portswigger.net/web-security/cors

MDN: Cross-Origin Resource Sharing (CORS) — https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS

Related patterns

• Missing security headers on a vibe-coded site
• API routes with no auth check