Skip to content

How to fix a wildcard CORS policy

Security1 min readFixes check cors-wildcard

Access-Control-Allow-Origin * on a page lets any site read its response. Only APIs meant to be public should use it.

Step by step, with screenshots: CORS wildcards: when Access-Control-Allow-Origin: * is dangerous →

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • Access-Control-Allow-Origin is not a wildcardwarning · −2 ptseffort S

Access-Control-Allow-Origin is * on the page itself

Why it matters. A wildcard lets any website read this response from inside a visitor's browser. Harmless for public files, risky for pages that differ per user, and dangerous when credentials are allowed too.

How to fix it.
  1. Send Access-Control-Allow-Origin only on API responses that need it, with the exact origin instead of *.
  2. Never combine * with Access-Control-Allow-Credentials: true.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.