{"id":"ia.cors","name":"CORS","verify":{"command":"curl -sI -H 'Origin: https://example.org' https://{domain}/","rescan":"isagentready results {domain} --checkpoint ia.cors","expect":"No Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true"},"fix":{"steps":[{"action":"Allow only the origins that need browser access to the API.","order":1,"language":"nginx","code_example":"add_header Access-Control-Allow-Origin \"https://app.example.com\" always;"},{"action":"Do not send Access-Control-Allow-Credentials: true with a * origin.","order":2,"language":null,"code_example":null}],"summary":"Send a deliberate Access-Control-Allow-Origin on API responses and never combine * with credentials.","skill":{"name":"security-trust","anchor":"ia.cors"}},"category":"security","aggregate":null,"references":[{"title":"MDN: CORS","kind":"guide","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS"}],"stage":"act","lifecycle":{"introduced":"2026-08-24","revised":["2026-09-02"],"retired":null,"replaced_by":null},"methodology_version":"2026-10-22","evidence_tier":"emerging","evidence_source":{"title":"MDN: CORS","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS"},"why":"CORS controls which origins can call your site from a browser. Public APIs need a deliberate CORS policy. A wildcard with credentials is not safe.","profiles":["api_tool_readiness"],"score_role":"bonus","legacy_id":"5.7","i18n":{"nl":{"name":"CORS","steps":["Sta alleen de origins toe die browsertoegang tot de API nodig hebben.","Stuur geen Access-Control-Allow-Credentials: true met een *-origin."],"why":"CORS bepaalt welke origins je site vanuit een browser mogen aanroepen. Publieke API's hebben een bewust CORS-beleid nodig. Een wildcard met credentials is niet veilig.","fix_summary":"Stuur een bewuste Access-Control-Allow-Origin op API-responses en combineer * nooit met credentials.","verify_expect":"Geen Access-Control-Allow-Origin: * samen met Access-Control-Allow-Credentials: true"}},"ar_practice_ids":[],"strength":"MAY","ar_mapping":"none","evidence_type":"recommendation","detail_url":"https://isagentready.com/en/methodology/checkpoints/ia.cors","maturity":"emerging","applicability":{"mode":"detected_surface","condition":null,"surfaces":["api"]}}