Access-Control-Allow-Origin: *. The dangerous pattern is reflecting the caller’s origin and allowing credentials.Browsers block JavaScript on one site from reading responses from a different site — the Same-Origin Policy. CORS is the mechanism that allows an API to explicitly opt in to cross-origin access for trusted sites. The API responds with HTTP headers telling the browser which origins are permitted.
Access-Control-Allow-Origin: https://app.yourcompany.comAccess-Control-Allow-Origin: [reflects caller’s Origin header]Access-Control-Allow-Credentials: trueDuring development: the frontend is at localhost:3000, the API is at localhost:8000. The developer adds Access-Control-Allow-Origin: * to stop browser errors. It works, it ships to production, it stays.
A slightly more dangerous pattern: the developer wants to support multiple frontends, so they write code that reads the incoming Origin header and reflects it back in the response. Every origin is “allowed” — including the attacker’s. When combined with Access-Control-Allow-Credentials: true, this allows any website to make authenticated API calls and read the responses.