Overly permissive CORS

When it's actually a problem

A static HTML page served with Access-Control-Allow-Origin: * isn't an issue — it's publicly browsable anyway. The real risk is an API response (JSON) that contains user data: if the visitor is logged in (session cookie sent automatically) and a malicious site makes a request to your API from its own page, permissive CORS lets it read the response.

The fix

Replace * with the explicit list of domains that legitimately need to call your API:

Access-Control-Allow-Origin: https://yourdomain.com

On Next.js (API routes):

export async function GET(req: Request) {
  const origin = req.headers.get('origin');
  const allowed = ['https://yourdomain.com'];

  return Response.json(data, {
    headers: {
      'Access-Control-Allow-Origin': allowed.includes(origin ?? '') ? origin! : '',
    },
  });
}

If your API doesn't need to be called from another domain at all, the simplest fix is to not send this header at all — by default, the browser already applies the most restrictive policy (same-origin only).