CORS Misconfigurations: Resolving Insecure Access-Control-Allow-Origin Headers

CORS Misconfigurations: Securing Cross-Origin Communication

Cross-Origin Resource Sharing (CORS) is a browser mechanism that allows servers to share resources across different origins. However, simple misconfigurations in CORS policies can leave private REST APIs vulnerable to cross-origin data exposure.

---

The Danger of Insecure CORS

The most dangerous CORS configuration is permitting wildcard credentials:

Access-Control-Allow-Origin: https://attacker-website.com
Access-Control-Allow-Credentials: true

If this header is present, any malicious website can execute requests on behalf of authenticated visitors, read the sensitive API responses, and exfiltrate user data.

---

Hardening CORS Policies

1. Avoid accepting dynamic Origin headers: Do not mirror the request Origin header dynamically unless matched against an allow-list database.
2. Never combine credentials with a wildcard: If Access-Control-Allow-Credentials is set to true, the origin must be explicit (e.g. https://app.startup.com).
3. Use strict headers in Node/Express:

app.use(cors({
  origin: ["https://app.trustlayerlabs.co.in", "https://trustlayerlabs.co.in"],
  credentials: true,
  methods: ["GET", "POST", "PUT", "DELETE"]
}));