Cross Origin Resource Sharing (CORS) is a way to punch hole in the security brought by a browser. If it is not done carefully, it may result into security vulnerabilities. CORS is an HTTP-header that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources. Reflecting the value from `Origin` request header in the `Access-Control-Allow-Origin` response header eliminates the protection as an adversary can cross-domain request from any origin.

Remediation

• Do no reflect the `Origin` header
• Specify a whitelist of domains from which requests are allowed.