Guides / open CORS misconfiguration

Open CORS: when Access-Control-Allow-Origin lets any site in

What an open or reflected CORS policy means for your API, how to test it, and how to restrict it safely.

What it is

CORS controls which other websites may read responses from your API in a visitor’s browser. Access-Control-Allow-Origin: * on a public, no-login API is often fine. The danger is when your API reflects whatever Origin it receives and also sends Access-Control-Allow-Credentials: true. Then any website your user visits can make requests as that user and read the answers. Browsers refuse the literal * together with credentials, which is why AI-written code often “fixes” CORS errors by reflecting the origin.

How to check

1. Run: curl -sI -H "Origin: https://evil.example" https://yourapp.com/api/your-endpoint
2. If the response says Access-Control-Allow-Origin: https://evil.example and Access-Control-Allow-Credentials: true, your CORS is open.
3. Or run a free Cobalt Owl scan.

Fix it with one prompt

Paste this into Lovable, Bolt, Cursor, v0, Replit or Claude Code:

My API reflects any Origin in Access-Control-Allow-Origin. Change the CORS config to allow only my own domains (list them explicitly), and never combine a wildcard or reflected origin with Access-Control-Allow-Credentials: true. Show me the change for my framework and host.

Review what the AI changes before you publish. If a key was exposed, rotate it even after the fix: anyone may already have a copy.

Sources

• MDN: CORS
• MDN: Access-Control-Allow-Origin

Last reviewed October 25, 2026. Cobalt Owl is an independent tool and is not affiliated with the builders or providers named here.