Never allow the null origin in CORS on Shopify
Why it matters
Any website can send requests with Origin null from a sandboxed frame, so allowing null with credentials lets every site read responses with your visitors' cookies. Remove null from the allowed origins.
The fix
Not possible on Shopify. Shopify sets the storefront's response headers and stores cannot change their CORS policy. If an app adds these headers on your domain, contact the app's developer.
Related
Scan your domain to see whether this applies to you.