{"slug":"cors-config-review","name":"CORS Config Review","version":"1.0.0","updated_at":"2026-10-19T07:15:28.613Z","use_when":"Reviews CORS code or server configuration (an Express or Flask handler, an nginx block, a framework setting) for the five mistakes that let a hostile web page read private responses, and lists only those, one line each with a fixed code, the place, why it is dangerous and the fix - or exactly No findings. It catches a request Origin copied into the allow header while cookies are allowed, a wildcard origin together with credentials, the null origin allowed, an origin check by suffix, substring or an unanchored pattern, and a per-origin allow header sent without Vary Origin. It leaves out the safe look-alikes, such as an exact allow-list with credentials and a public read-only API that answers with a wildcard and no credentials. Use to review CORS code before release, to audit a gateway config, or to debug a browser CORS error that looks like a server mistake.","not_for":"Preflight caching, private network access, cookie flags and headers other than the cross-origin ones. It reads one pasted handler or config and judges only what is written in it.","languages":["en"],"tags":["cors","credentials","origin","web-security","nginx","code-review"],"category":"code","category_url":"https://aiskills402.com/categories/code","keywords":["CORS code","wildcard origin","null origin","Vary Origin"],"faq":[{"q":"Star origin on a public read-only route: a finding?","a":"Only when credentials are allowed on the same response. A public read-only route that answers with the star and sets no cookie header is a normal setup and gets no line."},{"q":"Is an exact allow-list with credentials reported?","a":"No. Copying the request origin after a match against a set of full origins, with Vary Origin sent, is the safe form and gets no line. Copying the origin with no comparison is reported as reflection."},{"q":"What is the rule for the null origin?","a":"MDN notes that the origin can be the word null and offers no rule for it. Treating null as an allowed origin on a response with credentials is therefore the own policy of this skill, and its text says so openly."},{"q":"Where did the test go wrong?","a":"An Express handler with an ends-with check and no Vary, an nginx file with a null entry and one location that copies the origin, and a clean Flask handler. Claude Sonnet was right on all three. Claude Haiku was right on two and on the Express handler added a reflection line and a wildcard line; the second is defensible because the global middleware also runs on the status route, so that bait was not clean."}],"examples":[{"lang":"en","model":"claude-sonnet-5-5","input_excerpt":"const express = require('express');\nconst app = express();\n\napp.use((req, res, next) => {\n  const origin = req.headers.origin || '';\n  if (origin.endsWith('example.com')) {\n    res.setHeader('Access-Control-Allow-Origin', origin);\n    res.setHeader('Access-Control-Allow-Credentials', 'true');\n  }\n  next();\n});…","output_excerpt":"WEAK-ORIGIN-CHECK — global middleware, `origin.endsWith('example.com')` — a hostile site such as `evilexample.com` or `example.com.evil.com`-style lookalikes ending in `example.com` passes the check and gets credentialed read access to `/api/orders` — parse the origin and compare it against an exact list of full origins (e.g. `https://app.example.com`) or an anchored, escaped pattern…"}],"page_url":"https://aiskills402.com/skills/cors-config-review","markdown_url":"https://aiskills402.com/skills/cors-config-review.md","image_url":"https://cdn.aiskills402.com/og/skills/cors-config-review/a26bd65a.png","related_url":"https://api.aiskills402.com/v1/skills/cors-config-review/related","purchases_count":null,"tested":{"date":"2026-10-19","strong":{"model":"claude-sonnet-5-5 (Claude Code alias \"sonnet\")","verdict":"Right on all 3 cases, read by hand. On the Express handler it gave the suffix check and the missing Vary and left out the public status route. On the nginx file it gave the reflected origin in the upload location and the null entry in the map, and left out the exact allow-list. On the clean Flask handler it answered exactly No findings."},"weak":{"model":"claude-haiku-5-5 (Claude Code alias \"haiku\")","verdict":"Right on 2 of 3 cases, read by hand. It was right on the nginx file and on the clean Flask handler. On the Express handler it gave the suffix check and the missing Vary but also an origin-reflected line, although a comparison exists, and a wildcard-with-credentials line for the status route. The second remark is defensible, because the global middleware sets the credentials header before that route sets the star for a matching origin, so our bait was not fully clean; the reflection line contradicts the skill definition. The check counts both as misses and it is recorded as a wrong answer."},"note":"Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. Facts come from public documentation, read on 19 October 2026; there are no owner-measured facts. One input (the Express handler) turned out to carry an unintended second defect in the bait, disclosed in the verdicts.","report_url":null},"price_usd":"0.01","price_micro":10000,"size_bytes":6376,"sha256":"d297c9e8bd064e60a9f5ac9e7e12d853e73054e8ae4cf4f59b48b47944763648","outline":["What the MDN page says, as published on 19 October 2026","The answer","The codes","Rules","Work in this order","Short example"],"license":{"summary":"Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing","holder":"Georgi Kalchev, aiskills402.com","url":"https://aiskills402.com/docs#license"},"buy_url":"https://api.aiskills402.com/v1/skills/cors-config-review/file","redownload_url_template":"https://api.aiskills402.com/v1/purchases/{token}","mcp_tool":null,"payment":{"protocol":"x402","scheme":"exact","asset":"USDC","selling":true,"network":"base","network_caip2":"eip155:8453","pay_to":"0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4","facilitator":"cdp"},"seo_title":"CORS Config Review for Credentials and Origins","seo_description":"Reviews CORS code or server config for copied origins, star with credentials, null origin, weak origin checks and no Vary. Pay $0.01 once, in USDC.","versions":[{"version":"1.0.0","date":"2026-10-19","changelog":"# Changelog\n\n## 1.0.0 — 2026-10-19\n\nFirst release, written in the light-test batch of 19 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description.\n\nTest: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill text after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.\n"}]}