Never allow the null origin in CORS on nginx

Why it matters

Any website can send requests with Origin null from a sandboxed frame, so allowing null with credentials lets every site read responses with your visitors' cookies. Remove null from the allowed origins.

The fix

1. Remove null from any map or if block that sets Access-Control-Allow-Origin, or switch to an exact allow-list of https origins; run sudo nginx -t and reload.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Replace CORS origin reflection with an allow-list
• Drop credentials or the wildcard from CORS
• Limit CORS to the origins that need it