Only under specific conditions. A site’s JavaScript can read a cookie-authenticated API response from another origin only if the browser sends the credentials and the API’s CORS policy allows that requesting origin to read the response. The risky setup is not simply “wildcard CORS”: browsers reject Access-Control-Allow-Origin: * for credentialed response sharing. The danger is an origin policy that trusts too much—such as reflecting arbitrary Origin values—while allowing credentials.
How a cross-origin API request can expose a response
Browsers apply the same-origin policy to script-initiated requests. Cross-origin Fetch and XMLHttpRequest requests use CORS, which lets an API specify which requesting origins may read a response. The Access-Control-Allow-Origin response header carries that decision. MDN’s CORS guide explains the browser’s response-sharing rules.
As an Amazon Associate I earn from qualifying purchases.
A simple cross-origin request may reach the API before the browser decides whether the calling JavaScript can read the response. For a request that is not simple—for example, one using certain methods or headers—the browser first sends an OPTIONS preflight. It sends the actual request only if the preflight response permits it. A failed CORS check generally prevents JavaScript from reading the response; it does not necessarily mean the request was never sent.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The cookie must actually accompany the request
Fetch uses credentials: "same-origin" by default. Cross-origin code must normally request credentials explicitly with credentials: "include" for cookies to accompany the request. Even then, browser cookie rules still apply: cookies marked SameSite=Strict or SameSite=Lax are not sent cross-site, and third-party-cookie restrictions may block them. MDN’s Fetch credentials documentation describes these conditions.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The API must permit that origin to read the response
For credentialed CORS, the response must name a specific allowed origin in Access-Control-Allow-Origin and include Access-Control-Allow-Credentials: true. The wildcard value * is not valid for credentialed response sharing. So a wildcard alone does not let arbitrary sites read a user’s credentialed API response.
A more serious flaw is an unsafe origin decision: for example, accepting attacker-controlled origins or returning the request’s Origin value without checking it, while also permitting credentials. MDN warns against reflecting Origin blindly. Its CORS guidance notes: “Failure to set Access-Control-Allow-Origin appropriately will allow unauthorized origins to read the contents of any page on your site.” The same guide recommends limiting credentialed access to explicitly allowed origins.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose the CORS policy that matches the API
| API use | Origin policy | Credentials | Key consideration |
|---|---|---|---|
| Public data intended to be readable by any website | Access-Control-Allow-Origin: * may be appropriate |
Do not permit credentials | Use this only when the resource is genuinely public and does not need user-specific credentials. |
| Private or user-specific API used by selected browser clients | Allow only deliberately selected origins; return the matching approved origin | Set Access-Control-Allow-Credentials: true only where needed |
Keep the allowlist narrow and maintain it as client origins change. |
| No cross-origin browser access is required | Do not send CORS permission headers | Not applicable | Apply the policy only to the API resources that need it, rather than enabling it site-wide. |
When the server chooses a response origin dynamically from an allowlist, include Vary: Origin. This tells caches that the response can differ according to the incoming origin. MDN’s CORS configuration guidance covers this cache behavior.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How to check whether your API is exposed
- Inspect actual API responses. For representative allowed, disallowed, and absent
Originvalues, checkAccess-Control-Allow-OriginandAccess-Control-Allow-Credentials. Confirm that the server returns an origin only after matching it against the intended allowlist. - Check the origin-selection logic. Look for code or configuration that copies the incoming
Originheader into the response without validating it. Also confirm that credential permission is not added to resources or origins that do not need it. - Review preflight handling. For methods and headers that trigger preflight, inspect the
OPTIONSresponse and verify that it permits only the necessary origins, methods, and headers. Also check the normal response to the actual request. - Test authorization separately. Confirm that the API checks whether the requesting user may access each resource. CORS governs browser access to responses; it is not an authorization system and does not stop non-browser clients from making requests.
- Review CSRF defenses. If the application uses cookies for authentication, keep appropriate server-side protections against cross-site request forgery. A CORS policy does not replace them.
The OWASP Web Security Testing Guide v4 archive discusses checking CORS behavior and cautions that Origin can be spoofed outside a browser. Treat its testing guidance as historical and verify implementation details against current platform documentation.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What CORS does not protect
Browsers enforce CORS for browser JavaScript, but a server cannot rely on it to authenticate callers. Non-browser clients can send requests without obeying browser response-sharing rules, and an Origin header is not a trustworthy identity credential by itself. Keep application-level authorization on the server and validate access to each protected operation or record. For cookie-authenticated actions, retain CSRF protections as well.
The practical rule is narrow: allow only the browser origins that need access, use credential permission only where necessary, and enforce access independently of CORS.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
