CORS mistakes in apps built with AI coding tools
Reflecting any Origin and allowing credentials lets another website call your API as the visitor. An allowlist is the fix.
Cross-origin resource sharing is a browser rule. Another site can still send a request to your API. CORS decides whether the browser will let that page read the response, and whether the browser will attach cookies.
Access-Control-Allow-Origin: * means any site may read the response. The spec does not allow that wildcard together with Access-Control-Allow-Credentials: true, and browsers reject the combination. The pattern that exposes a cookie-authenticated API is the one coding agents often paste to silence a browser error: copy the request Origin into Access-Control-Allow-Origin, and set Access-Control-Allow-Credentials: true. Any website can then make a credentialed request and read the result.
What to send instead
- If the data is public and the API uses no cookies, a wildcard can be an intentional choice.
- If the API uses a session cookie, list the origins you own. Echo an Origin only when it is on that list.
- Vary the response on Origin when the allow header changes, so a cache does not store one site's header and serve it to another.
A browser error that says the request was blocked is the browser protecting the user. Opening the API to every origin removes that protection.