cors-security

CORS Security

Rules (for AI agents)

ALWAYS

• For any non-public endpoint, allow origins from an explicit allowlist. * is correct only when the resource is intentionally public and cross-origin access never carries credentials.
• When a cross-origin request carries credentials — the browser's credentials mode is include, meaning cookies, TLS client certificates, or browser-managed HTTP auth — respond with Access-Control-Allow-Credentials: true and a single explicit origin. On a credentialed request every CORS header loses its wildcard meaning: * in Allow-Origin, Allow-Methods, Allow-Headers, or Expose-Headers is read as the literal string "*" and the browser blocks the response. That is why "just set it to * for now" fails in a way that is hard to debug.
• Compare origins by exact match on the serialized origin — scheme, host, and port, all three. Never substring, prefix, or suffix matching: endsWith("example.com") accepts https://example.com.evil.com, and an unescaped . in ^https://api.example.com$ accepts https://apiXexample.com.
• Include Vary: Origin on any response whose headers depend on the request Origin, so a shared cache cannot hand one origin's Access-Control-Allow-Origin to another.
• Restrict Access-Control-Allow-Methods to the methods the endpoint accepts and Access-Control-Allow-Headers to the headers it consumes. An app-set Authorization: Bearer … header is not "credentials" in the Fetch sense — it is an ordinary header that must be listed in Allow-Headers and that triggers a preflight.
• Set a bounded Access-Control-Max-Age sized to the deployment; an hour to a day is a conservative production default. Browsers cap this value regardless of what you send, so a very large number buys no extra caching — it only lengthens how long a bad allowlist entry stays cached in clients that already fetched it.
• Source allowed origins only from operator-controlled configuration. Do not derive them from tenant- or user-controlled data unless an addition passes an authenticated, authorized, validated administrative workflow. The risk is not "stored in a database", it is "writable by anyone who can create a row".
• When the request Origin is not in the allowlist, omit Access-Control-Allow-Origin entirely. Do not fall back to a default trusted origin and do not echo the rejected value — a default-origin fallback silently grants every rejected caller whatever that default origin is allowed to do.