Skip to content
WebCureby Swasti
All loopholes
Medium

Wide-open CORS & missing security headers

Any website can call your API with your users' cookies.

What it is

CORS set to allow every origin with credentials lets other websites make requests as your logged-in users. Missing headers (CSP, HSTS, frame options) leave you open to clickjacking and script injection.

Why fast-built apps get it

A CORS error blocks you during development, and the quickest fix an AI suggests is “allow everything”. Security headers are never part of the feature request.

Before and after the cure

server.tsVulnerable
app.use(cors({
  origin: true,        // reflects any origin
  credentials: true,   // ...and sends users' cookies
}));
server.tsCured
app.use(cors({
  origin: ["https://app.yoursaas.com"],
  credentials: true,
}));
app.use(helmet({ contentSecurityPolicy: { /* your sources */ } }));

What it can cost you

  • Malicious sites acting on behalf of your users
  • Your app framed inside a phishing page
  • Injected scripts with nothing to stop them

Check your own app

  • Look for Access-Control-Allow-Origin: * or origin: true in your server config
  • Check your headers at securityheaders.com
  • Confirm cookies are HttpOnly, Secure and SameSite

The cure

  • Allow only your own origins
  • Add CSP, HSTS, frame and referrer headers
  • Set HttpOnly, Secure and SameSite on session cookies
Next loopholeSQL & command injection

Does your app have this one?

We'll check this and every other loophole on your app, then give you the cure.

Talk to us on WhatsApp