Replace CORS origin reflection with an allow-list on Apache

Why it matters

The server copies any Origin into Access-Control-Allow-Origin and allows credentials, so any website a logged-in visitor opens can read your responses with their cookies. Only origins on a fixed list should ever get that permission.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: replace rules that copy the Origin header with the allow-list below (mod_setenvif and mod_headers). Replace app\.your-domain\.com with your real origin, keeping the ^ and $ anchors and writing every dot as \. (an unescaped dot matches any character); for several origins use ^(https://a\.your-domain\.com|https://b\.your-domain\.com)$. The unset lines drop copies the application sends.
2. Stage 2: reload Apache and test your front ends.

SetEnvIf Origin "^(https://app\.your-domain\.com)$" CORS_ORIGIN=$1
Header onsuccess unset Access-Control-Allow-Origin
Header onsuccess unset Access-Control-Allow-Credentials
Header always unset Access-Control-Allow-Origin
Header always unset Access-Control-Allow-Credentials
Header always set Access-Control-Allow-Origin "%{CORS_ORIGIN}e" env=CORS_ORIGIN
Header always set Access-Control-Allow-Credentials "true" env=CORS_ORIGIN
Header always merge Vary Origin

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Never allow the null origin in CORS
• Drop credentials or the wildcard from CORS
• Limit CORS to the origins that need it