What CORS does
CORS controls which other websites may read your server's answers in the browser. Set up wrongly, it lets any website fetch data in your visitors' name.
How it works
Browsers keep websites apart. A script on evil.example may send a request to your server, but it may not read the answer. This rule is called the same-origin policy; an origin is the combination of scheme, host and port, such as https://example.com.
CORS (Cross-Origin Resource Sharing) is the controlled exception. With the request, the browser sends the page's origin in the Origin header. If your server answers with Access-Control-Allow-Origin and that origin (or *), the script may read the answer. With Access-Control-Allow-Credentials: true this also applies to requests carrying the visitor's cookies, which means their login.
For this, bytereport requests your start page once with a made-up foreign origin and looks at what your server sends back.
What matters
- Don't accept every origin. Some servers simply copy the
Originthey receive back intoAccess-Control-Allow-Origin. Then any website may read the answers. - Never together with credentials. If the server accepts any origin and allows cookies as well, any website can fetch logged-in visitors' data in their name. That is the most dangerous case.
*only for public content. For fonts, public data or an open API,Access-Control-Allow-Origin: *is fine. Browsers send no cookies with it. Answers with personal data should not be released this way.- A fixed list, not a mirror. If certain sites need access, the server checks the
Originagainst a fixed list and returns that origin only on a match, together withVary: Originso caches don't mix up the answers.
How to set it up
An ordinary website usually needs no CORS at all; the server then simply doesn't send the headers. Where it is needed, for an API or for fonts loaded by another domain, the answer names fixed addresses:
Access-Control-Allow-Origin: https://app.example.com
Vary: OriginCORS is configured in the web server, the CDN or, most often, the application: frameworks have a setting or middleware for it. An option like “allow all origins” combined with credentials is exactly the dangerous case. This is work for your developers or agency. Check API paths too, not just the start page: the report only sees the start page.