Intermediate LevelREST APIs & Web Services
How do you configure CORS to allow credentials (cookies, auth headers) safely across origins?
❓ Interview Prompt: Explain `Access-Control-Allow-Credentials: true`, restrictions on wildcard origin (`*`), and handling origin reflections safely.
When an API client needs to pass cookies or Authorization headers across origins, CORS rules strictly forbid wildcard origin configurations ('Access-Control-Allow-Origin: *'):
Rules for Credential Sharing:
1
If client sets 'credentials: 'include'' in 'fetch()', server MUST respond with 'Access-Control-Allow-Credentials: true'.
2
*No Wildcard '' Allowed**: Server MUST return the explicit requesting origin in 'Access-Control-Allow-Origin: https://app.example.com'.
3
Server verifies requesting origin against an allowed whitelist before reflecting it in the header!
Code Implementation Example
typescript
import cors from 'cors';
const allowedOrigins = ['https://app.example.com', 'https://admin.example.com'];
app.use(cors({
origin: (origin, callback) => {
if (!origin || allowedOrigins.includes(origin)) {
callback(null, true);
} else {
callback(new Error('Blocked by CORS origin security policy'));
}
},
credentials: true // Allows sending cookies across origins!
}));💡Express CORS configuration allowing credentials with whitelisted origin reflection.
🎯 Interview Key Takeaway
When enabling Access-Control-Allow-Credentials: true, never use wildcard origins; validate and reflect whitelisted requesting origins.
#CORS Credentials#Security#Cookies#Intermediate
Back to all REST APIs & Web Services Questions→