CORS with client https certificates

Question

I have a site with two https servers. One (frontend) serves up a UI made of static pages. The other (backend) serves up a microservice. Both of them happen to be using the sa

Answer 1

When using CORS with credentials (basic auth, cookies, client certificate, etc.):

• Access-Control-Allow-Credentials must be true
• Access-Control-Allow-Origin must not be *
• Access-Control-Allow-Origin must not be multi-value (neither duplicated nor comma-delimited)
• Access-Control-Allow-Origin must be set to exactly the value from the request's Origin header in order for the request to work (either hard-coded that way or if it passes a whitelist of allowed values)
• The preflight OPTIONS request must not require credentials (including the client certificate). Part of the purpose of the preflight is to ask what is allowed in a CORS request, and therefore sending credentials before knowing if they are allowed is incorrect.
• The preflight OPTIONS request must return a 200-level response, generally 204

Note: For Access-Control-Allow-Origin, you may want to consider allowing the value null since redirect chains (like the ones typically used for OAuth) can cause that Origin value in a request from a browser.