CORS Misconfiguration Fix for Vibe-Coded Apps

Quick answer

CORS misconfiguration is a common security flaw in vibe-coded apps. It occurs when your API allows requests from any origin (*) or reflects the Origin header without validation, enabling cross-origin attacks. The fix is to specify allowed origins explicitly and avoid using wildcards or dynamic reflection.

What to check first

Before diving into fixes, verify if your app has a CORS misconfiguration. Use a security headers checker to scan your API endpoints. Here's a quick checklist:

Step-by-step fix

1. Audit your current CORS configuration

Check your backend code for CORS setup. In a typical Node.js/Express app, it might look like:

// ❌ Bad: allows any origin
app.use(cors());

2. Set explicit allowed origins

Replace the wildcard with a whitelist of trusted origins. For production, this should be your frontend domain(s).

// ✅ Good: specify allowed origins
const allowedOrigins = ['https://myapp.com', 'https://admin.myapp.com'];

app.use(cors({
  origin: (origin, callback) => {
    if (!origin || allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  },
  credentials: true, // only if you need cookies/auth headers
}));

3. Avoid dynamic origin reflection

Never use code that reflects the Origin header back without validation:

// ❌ Bad: reflects any origin
app.use(cors({
  origin: (origin, callback) => callback(null, origin)
}));

4. Restrict methods and headers

Only expose the methods and headers your app actually uses:

app.use(cors({
  origin: allowedOrigins,
  methods: ['GET', 'POST'],
  allowedHeaders: ['Content-Type', 'Authorization'],
}));

5. Test your fix

Use a free CORS test or curl to verify:

curl -H "Origin: https://evil.com" -I https://api.yourdomain.com

If the response includes Access-Control-Allow-Origin: * or reflects the malicious origin, you still have a problem.

Common mistakes

FAQ

Why is CORS misconfiguration dangerous?

It allows malicious websites to make cross-origin requests to your API, potentially stealing user data or performing actions on behalf of authenticated users.

Can I use a wildcard origin if I don't use credentials?

Yes, but it's still not recommended for production. Wildcards expose your API to any website, which could lead to CSRF-like attacks or data scraping. Always specify allowed origins.

How do I know if my CORS is misconfigured?

Use a security headers checker or send a request with a fake Origin header and check the response. If it reflects your fake origin or returns *, it's misconfigured.