A wildcard on an authenticated surface is a data-protection failure anyone can observe without credentials.
Access-Control-Allow-Origin
CORS IANA permanent response reached by regulation
CORS decides whether a browser will let script from one origin read a response from another. Access-Control-Allow-Origin is the server’s answer, and * means “any origin may read this”.
On a genuinely public endpoint that is correct and useful. On an authenticated one it is a problem — and the reason it appears so often is that a wildcard is what makes the browser error go away, so it gets pasted in during debugging and never revisited.
It is one of the few negative signals in this catalog that is fully observable from outside: no credentials, no cooperation, one request.
The registry
Listed in the IANA HTTP Field Name Registry as a permanent entry. Defined in Fetch.
In the catalog
Declared by 30 providers across 3,087 published specification files in the API Evangelist catalog, where it appears as a response header — sent by the server.
Reached by regulation
No law names this header. It is evidentiary — the deployed control for an obligation that regulation does impose. It is observable at the edge: an unauthenticated request is enough to see whether a provider sends it.
Using it
Reflect a validated origin from an allowlist rather than sending *. If you need Access-Control-Allow-Credentials: true, the specification already forbids a wildcard — that combination is the specific mistake worth grepping your gateway config for. Remember to send Vary: Origin whenever the value is computed, or a shared cache will hand one tenant’s allowed origin to another.
Reached by these regulations
Catalogued at regulations.apievangelist.com, with the basis of each connection recorded rather than implied.
Governed by these rules
Machine-enforceable governance rules from rules.apievangelist.com that apply to this header when it appears in an OpenAPI.
OpenAPI Components Headers Error error
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Components Headers Info info
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Headers Hyphenated Pascal Case error
HTTP headers should follow Hyphenated-Pascal-Case naming convention for consistency and readability, such as Content-Type, X-Request-Id, or Accept-Language.
Guidance: Naming →OWASP API8 2023 Define CORS Origin error
Setting up CORS headers will control which websites can make browser-based HTTP requests to your API. The Access-Control-Allow-Origin header should be defined on all responses.
Guidance: Security →