Any website can read responses from your API
Overly permissive cross-origin policy
What this means
Your app tells browsers that any website may read its responses, and in some cases may do so with the visitor's credentials attached.
Why it matters
This turns every page your users visit into a possible attacker: a malicious site can quietly query your API as the signed-in user and read the answer. The user sees nothing.
How to fix it
- Allow only the origins that genuinely need access, and never combine a wildcard with credentials.
Prompt for your AI agent
Restrict the cross-origin policy to the specific origins that need it, and do not allow credentials together with a wildcard origin.
How to verify the fix: request the API from an unrelated origin and confirm the browser refuses to read the response
Classification: CWE-942 · A05:2021
References: cwe.mitre.org