Web Security · Middle · Question 31 of 75
Why is reflecting any request Origin back in Access-Control-Allow-Origin with credentials dangerous?
- ✓Correct answer: Any website can then read authenticated responses from your API in the victim's browser
- 2Because browsers block reflected origins
- 3It only causes extra preflight requests
Explanation
It's the same as allowing every origin with credentials. Compare against an exact allowlist instead.