Repository navigation
Is reflecting the CORS origin safe for a webhook? #1092
Description
💬 Question here
CORS is necessary because I need to send test requests from a browser (and a website I don't own). This is a bare-bones webhook that only supports POST & requires an Authorization header. Is it safe to reflect the request origin? I'm concerned because of a comment on the @fastify/cors readme:
const corsOptions = {
// This is NOT recommended for production as it enables reflection exploits
origin: true
};Your Environment
- node version: 22
- fastify version: >=5.0.0
- @fastify/cors version: >= 11.0.0
- os: Linux
Activity
Arunbhadouria commentedon Jun 19, 2026
Short answer: you're fine given your setup.
The reflection exploit the readme warns about only matters when combined with
credentials: true(which allows cookies/HTTP auth to be sent cross-origin). Without that, a malicious page can reflect any origin it wants — but the browser still won't attach session cookies, and yourAuthorizationheader acts as the real gate.Your threat model here is: can an attacker's page POST to your webhook without a valid token? No — CORS doesn't change that. CORS is purely a browser-side restriction; it doesn't protect your server, your
Authorizationcheck does.A few things worth confirming:
credentialsis not set totruein your CORS configAuthorizationcheck fires before any meaningful side effectsThe readme warning is aimed at APIs that use cookie sessions or rely on origin-checking as their auth layer — that's not what you're doing.