Permissive CORS with credentials
Part of the Production readiness check · fix arrives as a pull request
What it is
CORS reflects the request origin back in Access-Control-Allow-Origin while credentials is enabled — or sets a wildcard alongside credentials, which the browser refuses outright.
Why it matters
Origin reflection is the dangerous half: it lets any site make authenticated requests as your logged-in user and read the responses, defeating the same-origin protection your session cookie relied on. The wildcard pairing fails closed instead — browsers reject * with credentials — so it breaks the request rather than exposing it.
How to fix it
Replace the reflection with an explicit allow-list of origins you control, and check each request's origin against it. If a request genuinely needs no credentials, disable them rather than widening the origin.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.