Drop credentials or the wildcard from CORS on Cloudflare

headers.cors.wildcard_credentials · effort: minutes

Why it matters

Browsers refuse Access-Control-Allow-Origin * together with Access-Control-Allow-Credentials true, so the setup does not do what was intended. Public resources need no credentials, and private ones need a fixed list of origins.

The fix

Create a Response Header Transform Rule (Rules, Overview, Create rule) for this host with a Remove operation for Access-Control-Allow-Credentials, or remove it at the origin.

Read the documentation (opens in a new tab)

Reported by the CORS policy check
Replace CORS origin reflection with an allow-list
Never allow the null origin in CORS
Limit CORS to the origins that need it

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related