Replace CORS origin reflection with an allow-list on Cloudflare

Why it matters

The server copies any Origin into Access-Control-Allow-Origin and allows credentials, so any website a logged-in visitor opens can read your responses with their cookies. Only origins on a fixed list should ever get that permission.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stopgap at the edge: create a Response Header Transform Rule (Rules, Overview, Create rule) for the hostnames and paths that no other site needs to read, with Remove operations for Access-Control-Allow-Origin and Access-Control-Allow-Credentials.
2. Then fix the reflection where it is produced (the application or web server; see their tabs) so the allowed origins keep working, and narrow or delete the stopgap rule.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Never allow the null origin in CORS
• Drop credentials or the wildcard from CORS
• Limit CORS to the origins that need it