From 7e0184c53ddd66016270adc6620d0d5275b27d0f Mon Sep 17 00:00:00 2001 From: AchieverSana Date: Wed, 24 Jun 2026 13:47:09 +0530 Subject: [PATCH] docs: warn against combining origin: true with credentials: true Adds a note near the configuration options warning that origin: true + credentials: true allows any origin to make credentialed requests, since origin: true reflects the request's Origin header rather than restricting it. Closes #422 --- README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.md b/README.md index bd6ebbc1..41e6442c 100644 --- a/README.md +++ b/README.md @@ -234,6 +234,11 @@ app.listen(80, function () { * `preflightContinue`: Pass the CORS preflight response to the next handler. * `optionsSuccessStatus`: Provides a status code to use for successful `OPTIONS` requests, since some legacy browsers (IE11, various SmartTVs) choke on `204`. +> [!WARNING] +> **Avoid combining `origin: true` with `credentials: true`:** `origin: true` reflects whatever value is sent in the request's `Origin` header back as `Access-Control-Allow-Origin`, so it +> ends up authorizing *every* origin, not just one. Paired with `Access-Control-Allow-Credentials: true`, that means any website can make credentialed (cookie-bearing) requests to your API +and read the response. If you need to support multiple specific origins with credentials, use an array, a `RegExp`, or a function for the `origin` option instead. + The default configuration is the equivalent of: ```json