Home / Fix guides / Permissive CORS

Open CORS on your API: when Access-Control-Allow-Origin * is dangerous

Medium

Your API's CORS settings let other websites read its responses from a visitor's browser. With credentials allowed, a malicious site can act as your logged-in users.

Why it matters

AI-generated backends often add cors({ origin: true, credentials: true }) or Access-Control-Allow-Origin: * to make a CORS error go away.

Quick fix

Allow only your own front-end origins (an explicit list), never reflect the request's Origin.
Never combine credentials: true with a wildcard or reflected origin.
Public, non-user data can keep *; anything user-specific can't.

Step by step

Restrict origins

Example for a Next.js route handler:

const ALLOWED = ["https://yourapp.com", "https://www.yourapp.com"];
export async function OPTIONS(req) {
  const origin = req.headers.get("origin");
  const headers = ALLOWED.includes(origin)
    ? { "Access-Control-Allow-Origin": origin, "Vary": "Origin", "Access-Control-Allow-Methods": "GET,POST" }
    : {};
  return new Response(null, { status: 204, headers });
}

Prompt for your AI builder

Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.

Tighten the CORS configuration on my API. Replace any wildcard or reflected Origin with an explicit allow-list of my production and preview front-end domains, add Vary: Origin, and only send Access-Control-Allow-Credentials: true for allow-listed origins.

FAQ

How did Unspill test this?

With a single OPTIONS (preflight) request to one API path found in your bundle (or /api), sending a made-up Origin header, and checking whether your server allowed it. No data is read.

References

MDN: CORS

Check your app

Run a free scan