What is CORS?

1 min read Updated 2026-02-05

Cross-Origin Resource Sharing. A security mechanism that allows or restricts web applications from making requests to domains other than their own. Misconfigured CORS can lead to data theft.

Related: Same-Origin Policy XSS CSRF

Understanding CORS

CORS is a browser security feature that controls how web pages can request resources from different domains. When misconfigured (e.g., allowing all origins or reflecting the Origin header), it can allow malicious websites to steal user data or perform actions on behalf of authenticated users.

Examples

  • Setting Access-Control-Allow-Origin: * on sensitive endpoints
  • Reflecting the Origin header without validation
  • Allowing credentials with wildcard origins
  • Exposing sensitive headers unnecessarily

How to Prevent

  • Whitelist specific, trusted origins
  • Never use wildcard (*) with credentials
  • Validate the Origin header server-side
  • Only expose necessary headers
  • Use appropriate preflight caching

Worried about CORS in your app?

Our security audits identify vulnerabilities like this before attackers do. Get expert manual review of your codebase.

Get a Security Audit Back to Glossary