Beginner LevelAuthentication & Authorization
Why must Access-Control-Allow-Credentials: true be configured carefully with CORS?
❓ Interview Prompt: Explain Cross-Origin Resource Sharing (CORS), credentials mode, wildcard origin restrictions, and security risks.
CORS (Cross-Origin Resource Sharing) is a browser security mechanism that restricts cross-origin HTTP requests initiated from scripts.
The Credentials Security Boundary:
When an application makes cross-origin requests requiring cookies, HTTP authentication, or TLS client certificates, the client sets 'credentials: 'include''.
Key Security Rules:
1
When 'Access-Control-Allow-Credentials: true' is set on the server, *the server CANNOT specify a wildcard origin ('Access-Control-Allow-Origin: ')**.
2
Browsers will reject credentialed responses if the origin is set to '*'.
3
The server must dynamically validate incoming 'Origin' headers against an explicit whitelist of trusted domains and mirror back the validated origin!
Code Implementation Example
typescript
import cors from 'cors';
const allowedOrigins = ['https://app.company.com', 'https://admin.company.com'];
// Express CORS config with credential support
app.use(cors({
origin: (origin, callback) => {
if (!origin || allowedOrigins.includes(origin)) {
callback(null, true);
} else {
callback(new Error('CORS Policy: Origin not allowed'));
}
},
credentials: true // Permits sending cookies across origins safely
}));💡Configuring Express CORS middleware with explicit origin whitelist and credentials support.
🎯 Interview Key Takeaway
When enabling Access-Control-Allow-Credentials, servers must explicitly mirror allowed origins instead of using wildcard *.
#CORS#Security#Credentials#HTTP Headers#Beginner
Back to all Authentication & Authorization Questions→