Playbook

Debugging CORS Origin Bugs

A practical way to inspect origin parsing, credentials, and header behavior.

Pattern

Origin matching accepts or rejects the wrong host because parsing is too loose.

warningSymptoms

  • arrow_rightBrowser-only failures
  • arrow_rightCredentials rejected
  • arrow_rightUnexpected origin allowed

searchWhere to look

  • arrow_rightOrigin parser
  • arrow_rightAllowed list checks
  • arrow_rightCredential headers
  • arrow_rightSubdomain and suffix matching

buildCommon fixes

  • arrow_rightParse origins as URLs
  • arrow_rightCompare hostnames exactly where required
  • arrow_rightAdd edge-case tests

Practice challenges