Requests and files Required

Share data across sites on purpose

Allow other sites to read your API only from a fixed list of origins. Never copy the request's Origin into the reply when cookies are allowed.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Compare the Origin with a list and answer only for exact matches. Send Access-Control-Allow-Credentials: true only for those. A public API without cookies can allow *.

Example

curl -sI -H 'Origin: https://evil.example.net' https://api.staging.example.com/me | grep -i access-control

How to check

The agent sends requests to an API that uses cookies, with Origin: https://evil.example.net, Origin: null and Origin: https://example.com.evil.example.net. No reply allows any of them.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/strict-cors.