Enhancing security in CORS
CORS by itself does not provide any security, except for the domain allowed in the Access-Control-Allow-Origin header.
Some recommended practices for better security when using CORS are as follows:
Place the CORS header only on page(s) that need it; do not add the header across site
Use
Access-Control-Allow-Origin:*only for publicly accessible static resources that do not include sensitive information or modify data
Limiting access when using the Access-Control-Allow-Origin, * wildcard
Although the CORS specification suggests that a list of allowed domains may be provided, in practice, very few clients support a list of allowed domains. Therefore, if you need to allow more than one domain, you must allow all domains with the Access-Control-Allow-Origin, * wildcard. Then, any domain, even the ones that are not intended, can make a CORS request to the page with the header.
You must provide additional security when using the wildcard if you want to prevent CORS requests...
