Never allow the null origin in CORS

Why it matters

Any website can send requests with Origin null from a sandboxed frame, so allowing null with credentials lets every site read responses with your visitors' cookies. Remove null from the allowed origins.

The fix

1. Find the CORS configuration and remove null from the allowed origins. It is often added for local file testing or development.
2. Make sure the code does not echo an incoming Origin of null; compare against a fixed list of https origins and send no CORS headers otherwise.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Replace CORS origin reflection with an allow-list
• Drop credentials or the wildcard from CORS
• Limit CORS to the origins that need it