Browser & Web Performance · Senior · Question 39 of 75
What's wrong with this CORS check?
const origin = req.headers.origin;
if (origin && origin.endsWith("example.com")) {
res.setHeader("Access-Control-Allow-Origin", origin);
res.setHeader("Access-Control-Allow-Credentials", "true");
}- 1
endsWithdoesn't work on headers - ✓Correct answer:
https://evilexample.comalso passes, and with credentials the attacker's site can read users' data - 3Nothing, this is the recommended pattern
Explanation
Compare against an exact allowlist of full origins (scheme + host + port). Suffix and regex checks are a classic CORS bug.