CORS Security Best Practices

CORS Security Best Practices

1. Do Not Use Access-Control-Allow-Origin: * with Credentials

Always specify the exact origin when credentials are involved.

2. Whitelist Specific Origins

const allowedOrigins = ["https://myapp.com", "https://admin.myapp.com"];
app.use((req, res, next) => {
  const origin = req.headers.origin;
  if (allowedOrigins.includes(origin)) {
    res.header("Access-Control-Allow-Origin", origin);
  }
  next();
});

3. Restrict Methods and Headers

Only allow the methods and headers you actually use:

Access-Control-Allow-Methods: GET, POST // not PUT, DELETE unless needed
Access-Control-Allow-Headers: Content-Type, Authorization // not *

4. Set Access-Control-Max-Age

Cache preflight results to reduce OPTIONS requests:

Access-Control-Max-Age: 3600 // 1 hour

5. Validate Origin on the Server

Do not blindly trust the Origin header. Validate it against a whitelist.

The Takeaway

CORS security: do not use * with credentials, whitelist specific origins, restrict methods and headers, set Access-Control-Max-Age to cache preflight, and validate the Origin header on the server.