Overly Permissive CORS with Credentials
This endpoint reflects any origin back in Access-Control-Allow-Origin while also allowing credentials.
Why it matters
This endpoint reflects any origin back in Access-Control-Allow-Origin while also allowing credentials. That combination lets a page on any domain make authenticated requests to your API using a logged-in user's session and read the responses — the browser's same-origin protection is doing nothing here.
How ShipReady detects it
Probes API endpoints for a permissive cross-origin policy. Endpoints are discovered from the page and its bundles, then filtered to the scanned origin — a link to another company's API docs is not ours to probe. Each is sent an Origin header from a domain that could not plausibly be allowlisted, and the response is read. A finding requires BOTH that the origin is reflected or wildcarded AND that credentials are allowed. Either alone is normal and safe; together they let any site read authenticated responses. Browsers reject a literal wildcard with credentials, so misconfigured servers echo the request origin instead — both shapes are recognised. Probes are memoised per endpoint, so an API surface referenced by ten routes is tested once.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.1.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
The endpoint '{endpoint}' allows credentialed cross-origin requests from any origin — either via a wildcard (*) or by reflecting the request's Origin header back without validating it. This lets any website read authenticated data on behalf of a logged-in user. Validate the Origin against an explicit allowlist of trusted domains instead of echoing it or using a wildcard.Frequently asked questions
- What does "Overly Permissive CORS with Credentials" mean?
- This endpoint reflects any origin back in Access-Control-Allow-Origin while also allowing credentials.
- How serious is it?
- ShipReady rates this high. Fix before launch. A real weakness that an attacker can act on.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check.
Related checks
Does your site have this?
ShipReady checks this and 73 other things across up to ten pages of your site. Free, no signup.
Scan my site