Medium ThreatWeb & Injection DefenseCWE-346
CORS Hardening: Origin Whitelisting & Preflight
Audit and harden CORS configurations by implementing strict origin whitelisting, avoiding null origin traps, and caching preflights.
Vulnerability Overview
Permissive CORS allows malicious sites to read authenticated data.
Wildcard origins or echoing the Origin header allow cross-origin data theft.
Vulnerable Code
res.setHeader('Access-Control-Allow-Origin', '*');Allows any domain.
Remediated Code
cors({ origin: ['https://trusted.com'] })Explicitly whitelists allowed domains.
Hardening Rules
- 1Never use * with credentials
- 2Avoid echoing Origin header dynamically
- 3Cache preflight requests
Frequently Asked Questions
Can I use localhost in CORS whitelist?
Only for local development, never in production.