Catalog
concept#Security#Integration#Architecture

Cross-Origin Resource Sharing (CORS)

CORS is a browser-enforced security and integration model that controls which external origins are allowed to access web resources.

Cross-Origin Resource Sharing (CORS) is a browser-enforced security and integration mechanism that controls which external origins may access a web application's resources.
Established
Medium

Classification

  • Medium
  • Technical
  • Architectural
  • Intermediate

Technical context

Web servers (Nginx, Apache) configurationAPI gateways and reverse proxiesCDNs with header injection capabilities

Principles & goals

Use explicit origin rules instead of broad wildcards.Minimize allowed methods and headers to what is necessary.Treat credentialed requests more restrictively than public requests.
Build
Domain, Team

Use cases & scenarios

Compromises

  • Overly permissive Allow-Origin settings can lead to data exposure.
  • Incorrect handling of credentials can enable cross-site leaks.
  • Relying on CORS alone does not replace server-side authentication.
  • Avoid '*' for Access-Control-Allow-Origin in production systems.
  • Whitelist explicit origins and update them automatically.
  • Separate policies for public and credentialed endpoints.

I/O & resources

  • List of expected origins
  • Server or API configuration access
  • Security and compliance requirements
  • Defined access-control headers
  • Documented CORS policy
  • Monitoring for blocked requests

Description

Cross-Origin Resource Sharing (CORS) is a browser-enforced security and integration mechanism that controls which external origins may access a web application's resources. It relies on standardized HTTP headers to allow or block cross-origin requests. Proper configuration of Access-Control headers affects both security and interoperability in modern web and API architectures.

✔

  • Enables controlled integrations between domains.
  • Reduces misconfiguration through standardized headers.
  • Improves security compared to unrestricted cross-origin access.

✖

  • Only enforced in browsers; server-to-server communication is unaffected.
  • Complex credential scenarios require precise configuration.
  • Misconfiguration can block legitimate integrations.

  • Number of blocked cross-origin requests

    Counts requests blocked by the browser due to missing CORS headers.

  • Configuration errors per release

    Measures faulty CORS setups that resulted in support tickets.

  • Number of allowed origins

    Number of origins maintained in whitelists, indicator of management overhead.

Configuring a REST API for SPA access

Example server configuration that sets Access-Control-Allow-Origin to the SPA domain and allows necessary methods.

Embedding a payment widget with CORS

Stepwise integration of a payment widget including whitelisting the widget origin and handling credentials.

Troubleshooting: CORS errors in the browser

Common causes and debugging steps for blocks due to same-origin policy and missing headers.

1

Analysis: Identify required origins and methods.

2

Configuration: Set access-control headers on the server or API gateway.

3

Test: Verify browser behavior and credentialed scenarios.

4

Monitoring: Monitor blocked requests and support cases.

⚠️ Technical debt & bottlenecks

  • Hard-coded origin lists in configuration files.
  • Insufficient tests for preflight and credentialed scenarios.
  • No monitoring for blocked cross-origin requests.
Header configuration errorsComplex credential scenariosDistributed origin lists
  • Setting Allow-Origin: * together with Allow-Credentials: true.
  • Ignoring preflight requests for complex requests.
  • Relying on CORS as the sole protection for sensitive APIs.
  • Browser error messages can be misleading and often lack server-side hints.
  • Incorrect combinations of credential headers block legitimate access.
  • Proxy or CDN header overwrites can unintentionally change policy.
HTTP protocol knowledgeServer configuration (setting headers)Basics of web security
Browser same-origin policyAPI security requirementsCross-domain integrations and single-page apps
  • • Browser implementations may vary slightly.
  • • Server must be able to set controlled access-control headers.
  • • With credentials, Access-Control-Allow-Origin cannot be a wildcard.