---
id: 3747
title: "Security Risks of Setting Access Control Allow Origin: *"
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/security-risks-of-setting-access-control-allow-origin/"
published_at: "2025-03-17 01:38"
tags: ["web-security", "data-exfiltration", "cors", "http-headers", "same-site"]
phying_url: "https://phying.com/item/3747"
lang: en
---

# Security Risks of Setting Access Control Allow Origin: *

## Summary

When wildcard CORS turns dangerous: with cookie auth, SameSite=None, credentials enabled, and a reflected origin, malicious sites can read authenticated responses. Fixes include SameSite Lax/Strict.

## Intelligence Metadata

- **Sources:** projectblack.io
- **Published:** 2025-03-17 01:38
- **Original:** https://projectblack.io/blog/security-risks-of-setting-access-control-allow-origin/
- **Phying News:** https://phying.com/item/3747