CORS and the Access-Control-Allow-Origin response header
Summary: PortSwigger's explainer describes the Access-Control-Allow-Origin response header as the core of CORS, the specification that provides controlled relaxation of the same-origin policy so one website domain can request resources from another. The header identifies the permitted origin, the browser compares it against the requesting site's origin and allows access if they match, and the spec permits multiple origins, the value null, or the wildcard *, though no browser supports multiple origins and the wildcard cannot be combined with credentialed requests.
What's compelling: The article states plainly that CORS does not protect against cross-site request forgery, and that poorly configured CORS may increase the possibility of CSRF attacks or worsen their impact. It also flags that some servers dynamically build the Access-Control-Allow-Origin header from the client-specified origin, a workaround it calls not secure.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026