security config_error ai_generated true

Access-Control-Allow-Origin: * with credentials

ID: security/cors-misconfiguration

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

CORS configured to allow all origins with credentials.

generic

Workarounds

  1. 92% success Whitelist specific allowed origins
  2. 90% success Never combine wildcard origin with credentials:true

Dead Ends

Common approaches that don't work:

  1. Set Access-Control-Allow-Origin: * for all endpoints 88% fail

    Allows any site to make authenticated requests

  2. Reflect Origin header without validation 85% fail

    Origin spoofing vulnerability