Drop credentials or the wildcard from CORS on nginx

headers.cors.wildcard_credentials · effort: minutes

Why it matters

Browsers refuse Access-Control-Allow-Origin * together with Access-Control-Allow-Credentials true, so the setup does not do what was intended. Public resources need no credentials, and private ones need a fixed list of origins.

The fix

Remove the add_header Access-Control-Allow-Credentials line (or hide the application's copy with proxy_hide_header Access-Control-Allow-Credentials;), run sudo nginx -t and reload.

Read the documentation (opens in a new tab)

Reported by the CORS policy check
Replace CORS origin reflection with an allow-list
Never allow the null origin in CORS
Limit CORS to the origins that need it

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related