Methodology
CORS
ia.cors · 5.7
Act
MAY
Recommendation
Why it matters
CORS controls which origins can call your site from a browser. Public APIs need a deliberate CORS policy. A wildcard with credentials is not safe.
How to fix it
Send a deliberate Access-Control-Allow-Origin on API responses and never combine * with credentials.
-
Allow only the origins that need browser access to the API.
add_header Access-Control-Allow-Origin "https://app.example.com" always; -
Do not send Access-Control-Allow-Credentials: true with a * origin.
Verify
curl -sI -H 'Origin: https://example.org' https://{domain}/
Expected: No Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true
Run a new scan for this checkpoint:
isagentready results {domain} --checkpoint ia.cors
Details Mapping, lifecycle and references
- AR mapping
- No AR practice
- Evidence source
- MDN: CORS
- Score role
- Bonus
- Introduced
- 2026-08-24
- Revised
- 2026-09-02
- Methodology version
- 2026-10-22