A municipal API reflects arbitrary Origin values in Access-Control-Allow-Origin while also allowing credentials. Why is this dangerous?
Select an answer to reveal the explanation.
Short Explanation
CORS is the bouncer deciding which websites may read your stuff with the user's cookies. If every Origin gets a VIP pass plus credentials, hostile pages can siphon data. Reflecting arbitrary origins with credentials is a serious misconfig.
Full Explanation
A dangerous CORS pattern pairs Access-Control-Allow-Credentials with Access-Control-Allow-Origin reflecting untrusted Origins (or using a wildcard incorrectly with credentials). Attacker-controlled sites can then read sensitive responses in a victim's browser session. Fix with an explicit allowlist of trusted origins and careful credential policy. CORS does not replace TLS and is unrelated to SameSite cookie requirements in the distractors.