Cross-Origin Resource Sharing, CORS, is a browser-level setting your server controls, and it's one of the more common misconfigurations Harbova's scan flags. It's also one of the least understood, mostly because it works invisibly right up until it doesn't.
What CORS actually decides
By default, a browser won't let a script running on one website make a request to a completely different website on a visitor's behalf, using that visitor's own logged-in session. CORS is the setting your server uses to explicitly say which other websites are allowed to break that default rule for your app specifically. A reasonable CORS setting names the specific sites that should be allowed, your own app's own domains, and nothing else.
What a wide-open setting actually allows
If your server is configured to allow requests from any origin at all, especially alongside credentials like cookies or session tokens, then a completely unrelated website, one a visitor happens to land on for any reason, can make requests to your app using that visitor's own active session, and read back the response. The visitor doesn't have to do anything wrong. They just have to have your app open, logged in, in another tab, while visiting a page built to take advantage of it.
Why this setting tends to end up wide open
During development, a wide-open CORS setting is genuinely convenient, it means nothing ever breaks while different parts of an app, or a separate frontend and backend, are still being wired together. That convenience setting is meant to get tightened before launch, and it's exactly the kind of configuration detail that's easy to forget once everything's working and there's no visible reason to revisit it.
How to check your own app
- Look at your server's CORS configuration directly, in whatever framework or platform you're using.
- Check whether it allows any origin, often shown as a wildcard, rather than a specific, named list of your own domains.
- Pay particular attention if a wildcard is combined with allowing credentials, since that combination is the version that actually exposes a logged-in visitor's session.
- If you're not sure how to read your own configuration, Harbova's free scan checks this specifically and flags it in plain language.
The fix
List the specific, exact domains that legitimately need to talk to your app, and restrict CORS to only those, rather than leaving it open to everything by default. It's a short configuration change, and it closes off a genuinely serious way for a visitor's own session to be used against them without their knowledge.
Related reading
- What a Broken CORS Policy Actually Lets a Stranger Do
- How to Check Whether Someone Can Just Edit the Price Your App Charges Them
- How to Check Whether Your "Forgot Password" Flow Is Actually Safe
Check your own CORS settings, and everything else on the outside-facing list, free.
Scan my app free