CORS configuration is restrictive

A CORS misconfiguration that combines Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true allows any website to make authenticated cross-origin API calls using the visitor's session cookies — a variant of CSRF. CWE-942 (Permissive Cross-domain Policy) and OWASP A05 (Security Misconfiguration) cover this. NIST 800-53 SC-7 requires boundary protection. Substring origin validation (e.g., origin.includes('yoursite.com')) is trivially bypassed with a domain like evil-yoursite.com. The wildcard origin tells browsers to skip the same-origin check entirely, making your API accessible to any script on the internet.

Use an explicit origin allowlist with exact string equality — not substring matching — and vary the response on Origin:

const ALLOWED_ORIGINS = [
  'https://yoursite.com',
  'https://www.yoursite.com',
  ...(process.env.NODE_ENV === 'development' ? ['http://localhost:3000'] : []),
]

export function corsHeaders(origin: string | null) {
  const allowed = origin && ALLOWED_ORIGINS.includes(origin)
    ? origin
    : ALLOWED_ORIGINS[0]!
  return {
    'Access-Control-Allow-Origin': allowed,
    'Access-Control-Allow-Credentials': 'true',
    'Vary': 'Origin',  // Required for correct CDN caching
  }
}

Never set Access-Control-Allow-Origin: * alongside Access-Control-Allow-Credentials: true — browsers will ignore credentials with a wildcard origin, breaking auth anyway.