cors-configuration
Installation
SKILL.md
CORS Configuration
Configure Cross-Origin Resource Sharing correctly. Misconfigured CORS is one of the most common vibe-coder mistakes -- wildcard origins with credentials enabled is equivalent to having no security at all.
The Rule
NEVER use Access-Control-Allow-Origin: * with credentials. ALWAYS whitelist specific origins.
Common Mistakes
| Mistake | Risk | Fix |
|---|---|---|
Origin: * with credentials |
Any site can steal user data | Whitelist specific origins |
Reflecting Origin header without validation |
Attacker controls allowed origin | Check against allowlist |
Allowing null origin |
Sandboxed iframes can exploit | Never allow null |
Overly broad regex (*.example.com) |
evil-example.com matches |
Use exact string matching |
| Exposing all headers | Information leakage | Only expose needed headers |