2026-09-07 · 8 min read
- cors
- http
- security
Cross-Origin Resource Sharing lets a browser decide whether script from one origin may read a response from another origin. For requests outside the safelisted cases, the browser first sends an OPTIONS preflight describing the intended method and headers.
CORS is a browser response-reading policy, not authentication or a firewall. Non-browser clients can still call a reachable API, so every endpoint needs its normal authorization and input validation.
Define an exact origin policy
An origin is the tuple of scheme, hostname, and port. Compare a parsed or framework-provided Origin value against a constrained server-side allowlist; do not use substring, suffix, or loose regular-expression matching that accepts lookalike hosts.
- Allow only origins required by supported applications.
- Treat absent and opaque null origins according to an explicit policy.
- Return an explicit origin for credentialed requests.
- Apply the same policy to successful and error responses.
Validate the requested operation
The preflight request names its intended method and non-safelisted headers. Answer with only methods and headers that the selected origin may actually use, and make sure the application route enforces the same contract.
Route OPTIONS deliberately through the gateway and application stack. Authentication middleware should not demand user credentials from an automatic preflight, but the following application request must still authenticate normally.
Cache policy without sharing it incorrectly
Access-Control-Max-Age allows a browser to cache a successful permission result, subject to browser-specific caps. Choose a bounded duration that balances preflight traffic with the time required to revoke or change policy.
- Emit Vary: Origin when responses differ by origin.
- Account for requested method and headers in gateway cache behavior.
- Do not cache one tenant's dynamic origin decision for another.
- Roll out policy changes with existing browser cache lifetimes in mind.
Verify from the browser boundary
Use Flashman's URL tool to inspect exact origins and redirects, JSON formatter for sanitized policy logs, diff for gateway and application headers, timestamp converter for cache windows, and case converter to compare configuration names. Browser developer tools remain the authoritative view of the exchange.
Test allowed and denied origins, methods, headers, credentials, redirects, OPTIONS errors, ordinary API errors, CDN caching, policy revocation, private browsing, and every supported browser.