title: CORS Security: Set Access-Control-Allow-Origin to Origin on Request Header
body: <p>I am unsure of the finer points of the security with regards Access-Control-Allow-Origin and cookies etc.</p>
  
  <p>I was trying to produce an API that allowed authentication from any website. As such I needed to set:</p>
  
  <p><code>Access-Control-Allow-Origin</code> to <code>*</code> and</p>
  
  <p><code>Access-Control-Allow-Credentials</code> to <code>true</code></p>
  
  <p><em>This is not allowed due to security constraints.</em></p>
  
  <p>However what would be the problem with setting the <code>Access-Control-Allow-Origin</code> response header to the value of the <code>Origin</code> header of the request? Is that a massive security hole?!</p>
  
  <p>e.g. (node)</p>
  
  <pre><code>// CORS
  app.all('*', function (req, res, next) {
      res.header('Access-Control-Allow-Origin', req.headers.origin);
      res.header('Access-Control-Allow-Headers', 'origin, content-type, accept');
      res.header('Access-Control-Allow-Credentials', 'true');
      res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
  
      if (req.method == 'OPTIONS') {
          res.status(200).end();
      }
  
      next();
  });
  </code></pre>