Can other websites read your API?
The CORS settings of the API addresses your app calls, and whether they let any website read responses on your signed-in users' behalf.
Why it matters
Your API is where the data is. If it reflects any origin and allows credentials, a page on another site could call it from your user's browser and read the answers, as if it were your app.
How a survey checks it
Verified check: runs once you prove you own the site.
This is a verified check. We find up to five of your own API addresses in your code and send one ordinary request to each with an Origin header naming a site that cannot exist. We never send cookies or sign in.
How to fix it
- Allow only your own front-end origins, listed exactly.
- Do not reflect the request's origin back, and never pair an open origin with credentials.
- Check your framework's CORS settings for a development default left in place.
Prefer us to do it? Ask for a fix quote
Common questions
My API uses tokens, not cookies. Does this matter?
Less, because the browser does not attach tokens on its own. It still matters if any endpoint accepts cookies or returns data without one.
What does a null origin mean?
Some sandboxed pages send the origin "null". Trusting it lets those pages read your responses, so it should not be allowed with credentials.