cors-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/cors-security/SKILL.md. --> # CORS Security Strict CORS: no wildcard with credentials, exact-match origin allowlists, sane preflight cache, minimal exposed headers. Use when generating CORS middleware or framework config, setting CORS headers in API Gateway, CloudFront, or Nginx, or reviewing a cross-origin browser-facing endpoint. ## ALWAYS - For any non-public endpoint, allow origins from an explicit allowlist. `*` is correct only when the resource is intentionally public *and* cross-origin access never carries credentials. - When a cross-origin request carries credentials — the browser's credentials mode is `include`, meaning cookies, TLS client certificates, or browser-managed HTTP auth — respond with `Access-Control-Allow-Credentials: true` and a **single explicit origin**. On a credentialed request every CORS header loses its wildcard meaning: `*` in `Allow-Origin`, `Allow-Methods`, `Allow-Headers`, or `Expose-Headers` is read as the literal string `"*"` and the browser blocks the response. That is why "just set it to `*` for now" fails in a way that is hard to debug. - Compare origins by exact match on the **serialized** origin — scheme, host, and port, all three. Never substring, prefix, or suffix matching: `endsWith("example.com")` accepts `https://example.com.evil.com`, and an unescaped `.` in `^https://api.example.com$