The CORS policy pairs a wildcard origin with credentials

MediumConfirmedQuick winweb.cors.wildcard-with-credentials

What this check looks for

The response says every website is allowed, and also that cookies should be sent. Browsers refuse that combination, so the cross-origin request fails and nothing is shared.

Why it matters

Nothing is exposed by this — but nothing works either, and that is the danger. The policy was written and never tested against a browser, and the change people reach for when they find it broken is to echo the caller's origin instead, which is the single worst CORS misconfiguration there is.

When the check passes, your report says: “A wildcard origin is used without credentials, as browsers require”.

What it costs your score

When this check fails it removes 8 points from your Web security score, before the status, confidence and repeat multipliers are applied. Web security carries a weight of 8 in the overall score.

It shares the web-security.cors family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Web security. One underlying problem showing up in several places is still one problem.

Severity: medium
Default confidence: confirmed
Status when triggered: warn
Deduction: 8 points
Family cap: web-security.cors · 35
Category: Web security
Module: Web cors
Fix owned by: user
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Decide which of the two you meant, and configure that one properly.

Browsers reject the pair, so the credentialed access you asked for is not working at all.

If the endpoint is public and needs no cookies: drop Access-Control-Allow-Credentials entirely and keep Access-Control-Allow-Origin: *.
If it genuinely needs credentials: keep them, and replace the wildcard with a fixed allow-list of the exact origins that may use it.
Do not resolve this by echoing the request's Origin header back — that is what makes it exploitable rather than merely broken. Compare against a fixed set and return the matched value.
Add Vary: Origin alongside the allow-list, so a cache cannot serve one origin's response to another.

How to confirm it worked

curl -sSI -H 'Origin: https://not-your-site.example' https://‹host›/ | grep -iE '^access-control-allow-(origin|credentials):' — the two must never both appear with a wildcard origin

The configuration to publish

# Public endpoint, no cookies:
Access-Control-Allow-Origin: *

# Or credentialed, allow-listed:
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Vary: Origin

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

nginx

# http scope. The map is the allow-list: an origin that is not a key here gets "".
map $http_origin $cors_origin {
	default                     "";
	"https://app.example.com"   "https://app.example.com";
	"https://admin.example.com" "https://admin.example.com";
}

# Credentials are granted only when the origin matched.
map $cors_origin $cors_credentials {
	default "";
	~.      "true";
}

server {
	location /api/ {
		add_header Access-Control-Allow-Origin      $cors_origin always;
		add_header Access-Control-Allow-Credentials $cors_credentials always;
		add_header Access-Control-Allow-Methods     "GET, POST, OPTIONS" always;
		add_header Access-Control-Allow-Headers     "Authorization, Content-Type" always;
		add_header Access-Control-Max-Age           "600" always;
		add_header Vary                             "Origin" always;

		if ($request_method = OPTIONS) {
			return 204;
		}
	}
}

Apache

<IfModule mod_headers.c>
	# The capture group is the allow-list: only these exact origins set the variable.
	SetEnvIf Origin "^(https://app\.example\.com)$"   CORS_ORIGIN=$1
	SetEnvIf Origin "^(https://admin\.example\.com)$" CORS_ORIGIN=$1

	Header always set Access-Control-Allow-Origin      "%{CORS_ORIGIN}e" env=CORS_ORIGIN
	Header always set Access-Control-Allow-Credentials "true"            env=CORS_ORIGIN
	Header always set Access-Control-Allow-Methods     "GET, POST, OPTIONS" env=CORS_ORIGIN
	Header always set Access-Control-Allow-Headers     "Authorization, Content-Type" env=CORS_ORIGIN
	Header always set Access-Control-Max-Age           "600"             env=CORS_ORIGIN

	# Unconditional: the response varies by Origin whether or not this one matched.
	Header always append Vary Origin
</IfModule>

Caddy

@allowed_origin header Origin https://app.example.com

header @allowed_origin {
	Access-Control-Allow-Origin "https://app.example.com"
	Access-Control-Allow-Credentials "true"
	Access-Control-Allow-Methods "GET, POST, OPTIONS"
	Access-Control-Allow-Headers "Authorization, Content-Type"
	Access-Control-Max-Age "600"
}

# Unconditional, so caches key on Origin even for the unmatched response.
header Vary Origin

@preflight method OPTIONS
respond @preflight 204

Express

const ALLOWED_ORIGINS = new Set([
  'https://app.example.com',
  'https://admin.example.com',
]);

app.use((req, res, next) => {
  // Set unconditionally: the answer depends on Origin even when it is refused.
  res.vary('Origin');

  const origin = req.headers.origin;
  if (origin !== undefined && ALLOWED_ORIGINS.has(origin)) {
    res.setHeader('Access-Control-Allow-Origin', origin);
    res.setHeader('Access-Control-Allow-Credentials', 'true');
    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
    res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
    res.setHeader('Access-Control-Max-Age', '600');
  }
  if (req.method === 'OPTIONS') return res.sendStatus(204);
  next();
});

Cloudflare

Rules → Overview → Create rule → Response Header Transform Rule (path as at 2026-09), with an expression that tests the request Origin against a fixed list, e.g.
  http.request.headers["origin"][0] in {"https://app.example.com" "https://admin.example.com"}
and a matching rule that always sets Vary: Origin.

The map has to be at http scope — nginx has no allow-list construct inside location, and building one out of if there is the source of most broken nginx CORS configurations. nginx skips an add_header whose variable is empty, so an unmatched origin simply receives no CORS headers. always is required or the headers vanish on error responses and on the 204 preflight. Remember that any add_header inside a location discards every add_header inherited from the server block, so keep the whole set together.
Shown because the response identified Apache. SetEnvIf plus env= is the mechanism — Header set has no conditional form of its own, and anchoring the regex with ^…$ is what stops https://app.example.com.attacker.example matching. Put it in the virtual host: .htaccess runs too late for responses the server generates itself, including the preflight.
The header Origin <value> matcher compares the whole value, so it is an exact-match allow-list rather than a prefix test. Repeat the matcher and block for each additional origin.
The origin is written back only after the Set membership test, which is the difference between an allow-list and a reflection. Never build the set from a request value, an environment variable that is not reviewed, or a substring/endsWith test — https://app.example.com.attacker.example ends with nothing useful but starts with everything an attacker needs.
Treat this as a sketch of the approach rather than a copy-paste: the exact expression and the dynamic-value syntax differ between Cloudflare plans, and a static-value rule can only serve one origin. A Transform Rule also runs at Cloudflare's edge, so an origin that is reachable directly — by IP, or through a DNS record that is not proxied — still serves the policy measured here. Setting the allow-list at the origin covers both paths and is what we recommend.

Technical detail

The response to ‹origin› carried Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true. ‹detail›

The Fetch Standard's CORS check rejects this outright: when a request's credentials mode is include, the wildcard is not an acceptable value for Access-Control-Allow-Origin, and the browser fails the request and logs an error to the console. So the state today is that credentialed cross-origin calls to this endpoint do not work at all, and uncredentialed ones work through the wildcard.

Read it as evidence rather than as a vulnerability. Someone wanted credentialed cross-origin access, wrote the two headers that name the two things they wanted, and shipped without a browser ever exercising the path. The next step in that story is almost always to make the wildcard dynamic by echoing Origin — which does make the browser happy and is exactly web.cors.origin-reflected-with-credentials. Skip that step.

Detected server: ‹detected server›.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the web cors checker Build the fix