CORS and cross-origin reads

Which other sites’ scripts may read this one’s pages. An origin echoed back with credentials allowed lets any page a signed-in visitor opens read this site as them.

• Help center

Browsers stop a script on one site from reading responses from another site, unless the other site allows it with CORS headers. Access-Control-Allow-Origin names which origins may read; Access-Control-Allow-Credentials: true lets that read include the visitor's cookies. Misconfigured, these headers let any website read your pages as a logged-in visitor sees them — personal data, tokens, account details.

How SiteScan checks it

The scanner requests the home page with an Origin header for a made-up site and looks at the answer:

• green “Same origin only”: no permission is given to the unknown site;
• amber *: any site may read the page, but without cookies — normal for public files on a CDN, unusual for a page;
• amber “Any origin (echoed)”: the server copies back whatever origin asks, which is a wildcard in disguise;
• red: the origin is echoed back and credentials are allowed — any page a signed-in visitor opens can read your site in their name.

How to fix

Keep an explicit allow-list of origins and compare the request's Origin against it; send nothing when it does not match. Never combine a reflected origin with Allow-Credentials: true. Most pages need no CORS headers at all — only APIs called from other domains do. The other rows of the group are explained under security headers.