DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
Web Security Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
hard
Web Security
A code review finds an Express API that reflects any incoming Origin header back as Access-Control-Allow-Origin, unconditionally, for every request. What's the risk?
A
No risk — reflecting the origin is always the correct, safe pattern
B
This effectively behaves like an unrestricted wildcard for credentialed requests, since ANY origin gets explicitly allowed — the allowlist check (validating against a known set) was skipped entirely
C
This only affects GET requests
D
This is safe as long as HTTPS is used
Check Answer