Getting CORS right

An allow-list, not a mirror

CORS is a decision about who you trust, so it must be an explicit list:

Tip: Check the Origin against a strict allow-list and only then echo that exact value; never reflect arbitrary origins, and never pair a reflected/* origin with Allow-Credentials: true. Keep genuinely secret data behind proper authentication rather than relying on CORS to hide it.