---
title: "Share data across sites on purpose · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/strict-cors
updated: 2026-10-20
licence: "All rights reserved"
---

# Share data across sites on purpose

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Requests and files](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files)
- Rule: Allow other sites to read your API only from a fixed list of origins. Never copy the request's `Origin` into the reply when cookies are allowed.
- How: Compare the `Origin` with a list and answer only for exact matches. Send `Access-Control-Allow-Credentials: true` only for those. Add `Vary: Origin`, so a cache never serves one origin's answer to another. A public API without cookies can allow `*`.
- Check: The agent sends requests to an API that uses cookies, with `Origin: https://evil.example.net`, `Origin: null` and `Origin: https://example.com.evil.example.net`. No reply allows any of them.

Example:

```sh
curl -sI -H 'Origin: https://evil.example.net' https://api.staging.example.com/me | grep -i access-control
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/strict-cors`.

- Previous: [Redirect only to your own pages](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/block-open-redirects)
- Next: [Check the origin of WebSocket connections](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/websocket-origin)
- [Requests and files](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files)