CodePark/ questions / CORS: what it really protects
START PRACTICINGPRACTICE
Frontend question · Frontend security › CORS: what it really protects

The API answers with Access-Control-Allow-Origin: *. The page calls fetch(url, { credentials: "include" }). What happens?

The page can't read the response: with credentials, the server must name the exact origin and send Access-Control-Allow-Credentials: true

Browsers don't accept the * wildcard for requests with credentials. The response must name one exact origin, such as Access-Control-Allow-Origin: https://app.example, and send Access-Control-Allow-Credentials: true. The server should check the origin against an allowlist and add Vary: Origin, so caches don't mix up answers.

"It works, because * allows every origin" is the tempting wrong answer. This rule exists so that no server can give every site access to logged-in data by accident. "The browser sends it without cookies" is wrong, because credentials: "include" sends them.