Cross origin rules

Browsers stop one site from reading another site's responses unless the second site says it is allowed. That permission is a response header, and the value is either a wildcard meaning every site, a reflection of whoever asked, or an explicit list of addresses you trust.

The wildcard usually arrives during development, when a page running locally needs to talk to a deployed backend and the fastest way through is to allow everything. It works, the afternoon continues, and the setting ships. Nothing fails afterwards, which is why it stays.

The combination that matters is a reflected origin together with credentials allowed. That tells the browser it is fine for another site to make requests using your visitor's session and read what comes back. A check can read both headers from outside with one request, which is why this is observable rather than declared.

• Any site can read your responses with a visitor's session

No incident in the library maps to this one yet.