CORS Misconfiguration

What this check looks for

StackShield sends cross-origin requests with varying Origin headers and reads how your application answers. It is inspecting the Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers, looking for the combination that opens your API to any site: a reflected or wildcard origin paired with credentialed requests.

The check is asking a simple question, which other websites does your API let read its responses.

Why it matters

CORS governs which external origins a browser will let read your API's responses. Configured correctly it is invisible. Configured to reflect any Origin back while also allowing credentials, it means a malicious website your logged-in user visits can make authenticated calls to your API and read the results, exfiltrating data through the user's own session.

The dangerous pattern is subtle because it often works fine in testing. Reflecting the request origin looks like "allow my frontends", but it actually means "allow every origin", including the attacker's.

What a failed check means

A failed check means your API returned a permissive cross-origin policy, most often a reflected origin with credentials allowed. That is the configuration that turns any site your users visit into a potential reader of their data.

The fix is an explicit allowlist of trusted origins rather than reflection or a wildcard, and enabling credentials only for those specific origins.

See the step-by-step remediation: how to fix this.