https://shipreadyai.dev/glossary/cross-origin-rules

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Cross origin rules

The header that decides which other sites may read your responses.

Browsers stop one site from reading another site's responses unless the second site says it is allowed. That permission is a response header, and the value is either a wildcard meaning every site, a reflection of whoever asked, or an explicit list of addresses you trust.

The wildcard usually arrives during development, when a page running locally needs to talk to a deployed backend and the fastest way through is to allow everything. It works, the afternoon continues, and the setting ships. Nothing fails afterwards, which is why it stays.

The combination that matters is a reflected origin together with credentials allowed. That tells the browser it is fine for another site to make requests using your visitor's session and read what comes back. A check can read both headers from outside with one request, which is why this is observable rather than declared.