Insecure CORS configuration
CORS controls which other websites are allowed to make authenticated requests to your app. The dangerous mistake is allowing any origin while also allowing credentials, which effectively lets any website act on behalf of your logged-in users.
What it looks like
Your API responds with Access-Control-Allow-Origin set to a wildcard, or reflects whatever origin asked, together with Access-Control-Allow-Credentials set to true. It was probably set wide open to make development easy and never tightened.
Why it matters
A malicious site a user visits can make authenticated calls to your API using that user's session, and read the responses. That turns a page visit into account actions and data theft.
How ArgosX detects it
ArgosX inspects your CORS response headers and flags the unsafe wildcard-with-credentials combination.
How to fix it
Allow only the specific origins you control.
- Replace the wildcard with an explicit allowlist of your own domains.
- Only send Access-Control-Allow-Credentials: true for those trusted origins.
- Never reflect the incoming Origin header back without checking it.
Check your own app for this, free.
A free scan runs in minutes, no signup. Where it finds this, it proves it with the request and screenshot, not just a maybe. A human-verified pass is available when you want a person to confirm every finding.