LetMeCheck.ai
    Start free
    CORS
    Security

    What is CORS?

    SHORT ANSWER

    CORS (cross-origin resource sharing) is a browser rule that controls which websites are allowed to call your app's API. Set correctly, only your own site can talk to your backend from a browser. Set to allow everyone, any website a user visits could make requests to your API using that user's login.

    Also called: Cross-origin resource sharing

    ON THIS PAGE
    What it meansWhy it matters for vibe-coded appsExampleHow to check if your app has this problemHow to fix it

    What it means

    Browsers protect people by stopping one website from quietly reading data from another. CORS is how your backend tells the browser which other websites are allowed through.

    It's a short list your server sends back with every response. The browser reads it and decides whether to hand the data to the page that asked.

    Why it matters for vibe-coded apps

    When something doesn't work during development, AI tools often "fix" CORS errors by allowing every website. The error goes away, and so does the protection.

    IF THIS IS WRONG IN YOUR APP
    • A malicious site could read your users' private data while they're logged in.
    • Your API can be used from anywhere, which makes abuse easier.
    • It's easy to miss, because everything looks normal to you.

    Example

    An Express backend for a React app.

    ✕ RISKYAny website is trusted, with the user's login
    // Any website can call your API with the user's login
app.use(cors({ origin: true, credentials: true }));
    ✓ SAFEROnly your own site is trusted
    app.use(cors({
  origin: ["https://yourapp.com"],
  credentials: true
}));

    List every domain you actually use, including your preview domain if you need it.

    How to check if your app has this problem

    1. 1Search your backend for cors( or Access-Control-Allow-Origin.
    2. 2Look for origin: '*', origin: true, or code that copies back whatever origin was sent.

    The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.

    Run a free scan →

    How to fix it

    1. 1Replace the wildcard with a list of your real domains.
    2. 2Only allow credentials (cookies and logins) for those domains.
    3. 3Test your app in the browser, then run a check again.
    FIX PROMPT · PASTE INTO YOUR AI TOOL

    Update the CORS settings on my backend so only https://yourapp.com and my preview domain are allowed, with credentials. Remove any wildcard or 'allow all' origin settings.

    Check if your app has this problem

    Paste your website and we'll check for CORS issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.

    Last updated

    Related terms

    Need help?

    Not sure what this means for your app? Our team will explain it in plain English.

    Contact support