CORS allows any origin (wildcard)
Access-Control-Allow-Origin: * lets browser scripts from any origin read a response when the request does not use credentials. This can be intentional for public resources. A wildcard finding alone does not prove that private data is exposed. Other audit tools often report this finding as "Access-Control-Allow-Origin wildcard".
Why this matters
Private responses need authentication and authorisation independently of CORS. Browsers reject credentialed response access with a wildcard origin. CORS controls browser response access; it is not a complete defence against cross-site request forgery or requests made outside a browser.
How to fix it
First identify whether the endpoint is public or private. Public, non-credentialed resources may keep the wildcard. For trusted browser clients accessing private data, validate the requesting Origin against an allowlist and return that one approved origin, not a comma-separated list. Add Vary: Origin when the header changes by origin. Enable credentials only if required, handle preflight requests, and test both approved and unapproved origins. Keep authentication and CSRF protections in place. The linked guide includes a verification checklist.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit