CORS for Cloudflare
medium4 checks
CORS decides which origins may read your API responses. A wildcard turns an authenticated API into a public one.
What Cloudflare must have
- Access-Control-Allow-Origin limited to known origins
- No wildcard combined with credentials
- No reflection of arbitrary Origin headers
- Preflight responses only allow the methods actually used
How to fix it
- 1Replace wildcards with an explicit allowlist
- 2Validate Origin before echoing it and reject unknown origins early
Cloudflare context
CDN, DNS and WAF provider sitting in front of the origin.
Origin IPs must be firewalled to Cloudflare only, otherwise the WAF is bypassable by hitting the origin directly.